Recommended way to add a field

(Yu Watanabe) #1

What is the recommended way to add a field after the log is collected into elasticsearch?

Situation is that lets say at first you are unsure which fields you want to use in the visualize but just want to collect logs. But after a while you find out the field you want to parse.

Of course amending logstash configuration is the best way but I am seeking any other efficient way to do it.

(Mark Walkom) #2

That is the best way.

You can add one via Console if you really want, but it's not efficient.

(Yu Watanabe) #3

Is scripted field be the way from Console?

(Mark Walkom) #4

Basically doing an update request on a document.

(system) #5