Hi
I want to ask is it possible and how to use filter to make to column join together?
For example, I have a column call brand and another column call name in my database.
I want to use filter to make it look like
"projectname" : "brand" "name"
in index.
Why not just do the join in the SELECT clause of your SQL query?
Because I do not have the right to modify the database.
You don't have to modify the database. I'm talking about concatenating the columns in the SELECT clause. Something like
SELECT (brand || " " || name) AS projectname, ... FROM ...
should work, possibly depending on your SQL dialect.
But sure, you could also use a Logstash filter:
mutate {
add_field => {
"projectname" => "%{brand} %{name}"
}
remove_field => ["brand", "name"]
}