Logstash data transformation or Kibana scripted field?

Elastic Stack Logstash
1

Consider this data that I'm going to index in elastic search. Should I implement it using logstash transformation or kibana scripted field? Which is the best practice?

Data mapping:
1 = apple
2 = orange
3 = mango

Elasticsearch indexed data
[ {fruit: 1}, {fruit: 2}, {fruit: 3} ]

The charts should use fruit names not the mapped numbers. The use case uses many data mappings.

Thanks,

2

Short answer: Logstash

Medium answer: Scripted fields are generated every time the data is queried for every row. It's uses necessary processes if you are able to generate the data before or during ingest. Logstash will process and make the new field 1 time and it's set.

1 Like
3

Thank you! I decided to use logstash translate plugin and just add a new field. I think this is the proper way. I will now be able to get rid of my scripted fields :smiley:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.