How to Fill Missing Interface Entry Values Using Corresponding System Entries with Logstash

Problem Explanation:
I have a dataset/index containing information about various network devices and their components. The dataset includes entries for different parts of each device, such as interfaces and system parts. However, some entries for the interfaces have missing or empty values for certain fields that are available in the corresponding system entries for the same device.

Goal:
My goal is to fill in the missing or empty values in the interface entries with the corresponding values from the system entries for the same device. Specifically, I want to:

  • Identify interface entries with missing or empty values.
  • Find the corresponding system entry for the same device.
  • Copy the values from the system entry to the interface entry if the values in the interface entry are missing or empty.

Solution Approach with Logstash:
I have used different aggregate filters but am not getting the desired results. Can anyone please help with this? Thanks!