I am working on a project where the log data can be used to determine a user's performance everyday. The work users do is converting physical documents to digital ones.
I have successfully loaded the data into elasticsearch via logstash but I am facing a small problem.
To measure a user's performance there are 3 main fields we're targeting - pageCount, docCount and imageCount (pages, docs and images scanned by a user for a given job)
The logs catch the doc-count and page-count as one individual field. However, the image count is broken down into 6 - colorFront, colorRear, blackandwhiteFront, blackandwhiteRear, grayscaleFront and grayscaleRear (it just categorizes the scanned images on their physical state - so if a image is color, it'll be logged under the color front and rear)
What I am trying to do is - make a new field -- ImageCount which adds the values of all the 6 sub-fields into one.
I have looked into scripted fields to tackle this but no success there. How can I add a new field ImageCount which adds all the 6 fields for a given record in the log?
I tried this method in the scripted fields - Adding a new column to a data table from a calculation based on two different columns in the same row
but when I do this, in the discover tab all other fields disappear?