Map Elasticsearch field to predefined list

Elastic Stack Elasticsearch
1

Hi

So I have question about how best to approach a problem I need to solve. In one of my indexes within ES I have the field:

user.id: U123456

This is great, however I have a list of username associated with user id's. So

U123456 = John

In kibana is there a way of just mapping this in the presentation layer? Do I have to add an if statement into my logstash and then add a new field in ES with the user.name field?

Whats the best way of doing this, which is manageable?

The data does not contain the username as is currently.

Thanks

2

The best option is to do it during ingestion, so Logstash.

3

Thanks for the reply,

Okay I will add some new logic to create a new field in logstash.

Thanks

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.