A common scenario in logging is the need to store the backend user performing the logging action. So using ES should I store the user id or its username in the document? After all, when retrieving logs, I need to return username instead of id to the API callers. So if I store id I'd need to map the id to username after retrieving from ES, as I kind of don't want to use the parent-child relationship feature. If I store username, will it be a waste of space, because there can't be too many backend users so there will be a lot same username text stored?
It'd make sense to do that if you can.
Otherwise you could store the username <> ID data in another index, then use an ingest pipeline to add the data to the events during ingestion.
1 Like
If you are in control of the structure of your logs, I would suggest that you log both the username and the id in the same document.
Something like: { "user": { "id": "user-id", "name": "user-name" } }.
It is a single keyword field, the difference in the space usage is barely perceptible, and having the id and the name in the same document can help you in the future when doing troubleshooting.
2 Likes
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.