Post processing of aggregation data

Elastic Stack Kibana
1

I posted a feature request for Kibana around getting label data for numerical ids that are stored in elasticsearch before displaying that data in a visualization:

We don't want to denormalize our event data to contain all of the other relevant info besides the ids so I'm looking for an alternative solution. They suggested that I post here as well. Anyone out there have a good solution for storing ids in elasticsearch but then being able to associate those ids with their labels (from another data store but can be made available via a rest endpoint or by syncing them into elasticsearch) for presentation purposes?

2

If the mapping is sufficiently static, you can consider doing it at index time and just storing the descriptive label as a separate field in the same document (for instance using the Logstash translate filter).

3

That's not a bad idea Tanya. Unfortunately, the labels can and will change, so having stale data in the index is not desirable. That's one of the main reasons why we don't want to de-normalize the data stored in the index.