We are migrating Auditing in our project from Oracle to ELK. For this , while creating a report/Visualization , we need to add a new column instance , value of which would be like(S1,S2,S3,S4) based on two parameters consumer and circle. Earlier in oracle we had created a table with around 1000 entries with three columns Consumer , Circle and Instance.
We were fetching instance values from this table on the basis of Circle and Consumer at the time of generating report, As consumer and circle are available in live traffic
Can anyone help me to develop similar logic in ELK