Map Elasticsearch field to predefined list


#1

Hi

So I have question about how best to approach a problem I need to solve. In one of my indexes within ES I have the field:

user.id: U123456

This is great, however I have a list of username associated with user id's. So

U123456 = John

In kibana is there a way of just mapping this in the presentation layer? Do I have to add an if statement into my logstash and then add a new field in ES with the user.name field?

Whats the best way of doing this, which is manageable?

The data does not contain the username as is currently.

Thanks


(Mark Walkom) #2

The best option is to do it during ingestion, so Logstash.


#3

Thanks for the reply,

Okay I will add some new logic to create a new field in logstash.

Thanks


(system) closed #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.