Lookup fields / index

[Tuckson (Eric)]

Hi,

Consider an index with a field with error-codes in it (version 7.14.1) .
Is it possible to (for example) have another index (or another way to store a list of key:value data) with the errorcode as key and a descriptive name and/or even a longer description, and to have it replaced in reports and dashboards so people see the meaningful name / description instead of just the code?

Cheers,

[dosant (Anton Dosov)]

I'd use a "static lookup" field formatter for this.
Edit index pattern -> edit field -> add static lookup formatter

Is it possible to (for example) have another index (or another way to store a list of key:value data)

I don't think this is possible, but I think to avoid manually populating the list for each error code field in every index pattern you need you could automate this by using Index Pattern API (experimental) Update index pattern fields API | Kibana Guide [8.11] | Elastic to apply a field formatter to a field.

An alternative to a static lookup field formatter could be a runtime field. You could define a new field on an index pattern that would infer error description from an error code. You could add this field from index pattern management or using an API (experimental)