New field creation in kibana

Elastic Stack Kibana
1

HI Team,
I have few question and need to know whether its possible to achieve it or not,

i have parsed logs information via logstash to Elasticsearch and index created. i want to extract specific data from my message is that any way is available to achieve it. I know how to achieve this via logstash config and i dont want to change current config of logstash..

2

You can do this using scripted fields: https://www.elastic.co/guide/en/kibana/current/scripted-fields.html

However, it's highly recommended to use logstash for this, because scripted fields will be significantly slower. This is especially relevant when you are using them in filters.

3

For Example: i have message and i need to extract user id value in that message. so i can achieve that via above method?

4

Yes, in the script you can access the current document and use things like regexes to extract things from another string field.

5

Thanks a lot @flash1293 will work around let you know the status

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.