Runtime field kibana

Elastic Stack Elasticsearch
1

hi,

i want make three new field that capture alert, source address and destination address from message field. anyone can help me how to do it. i have try using runtime field, but i cannot extract the value from the message using emit(doc['message'].value) and getting match_only_text fields do not support sorting and aggregations error.

image
image1290×653 84.5 KB

2

Does the message.keyword field exist on your dataset? You can try using that to fix the error.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.