Hello,
I suppose that makes sense that you can't create a separate column in a table but at the ingest/pipeline level you should at least be able to create an entirely new field in an index, right?
Theoretically if I have a field integer "bytes" being stored in my index, I should be able to "process that field" with some form of logic and say "if I see field 'bytes' in a document with a value greater than 10000, add a value of 1 to new field "High Transfer."
This is definitely a new beast for me, certainly without a having clause I've been struggling a bit but there has got to be a way to count the occurrences of a field in a document that matches some logic and store it in a new field.