Map Elasticsearch field to predefined list



So I have question about how best to approach a problem I need to solve. In one of my indexes within ES I have the field: U123456

This is great, however I have a list of username associated with user id's. So

U123456 = John

In kibana is there a way of just mapping this in the presentation layer? Do I have to add an if statement into my logstash and then add a new field in ES with the field?

Whats the best way of doing this, which is manageable?

The data does not contain the username as is currently.


(Mark Walkom) #2

The best option is to do it during ingestion, so Logstash.


Thanks for the reply,

Okay I will add some new logic to create a new field in logstash.


(system) closed #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.