Map keyword values for display

Elastic Stack Kibana
1

Hi,
I'm relatively new to working with ELK, and I haven't found a response to this question yet.
For storage optimization reasons, I want to use some aliases in my input files to store fixed values.
However I would like to display information in a pretty and readable format.
For instance, I have a field "status" in my dataset that can take 3 values: Civilian, Military and Student.
I would like to use some keys so I can store the information in a compact format, for instance:
1 => Civilian
2 => Military
3 => Student

How could I manage to then display the labelled information instead of the keys?

Thanks in advance,
Regards,
Arnaud

2

Multiple ways this could be done depending on your pipeline.

The best way is to shape the data coming in to do this using ingest processor or logstash translate filter if your data is going through there.

But if that's not an option the a runtime or scripted field using static lookup would work.

3

Indeed, the static lookup filter in the index pattern was exactly what I needed!
Thank you very much

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.