Tagging - Correlating Between Datasets

Elastic Stack Kibana
1

Hello,

I want to do something like add tags but to datasets.
I know I can use an ingest pipeline and then apply it all ingest pipelines but this isn't practical as updates to tags can't be retroactive.

Is it possible to do something like this in between a runtime field and a ingest pipeline?

2

Can you provide more context?

It is not clear what you mean by tagging datasets and how this would be used.

3

Yes,
So lets say I have multiple data sources, and I have host.name field in all of them. I would like to add like a runtime field like "tags" or add to "tags" to all data sources where there's an instance of host.name: "Elastic01" and so then in each data view it will have the runtime field tags: "Elastic Nodes".

So then if I want to find all instance across all data sources, I just use tags: "Elastic Nodes"

4

Yeah, this would be like adding a tag into the tags field, which is used for cases like this.

The way to do that is what you described, using ingest pipelines.

Not sure if you can do that with runtime fields, but I do not use them because they can be extremely expensive on searchs.

Do you really need it to be applied to older data? Depend on what you want to do you may be able to do that using update_by_query to add the tag into the tags field.

If it is just a couple of hosts you want to tag it would not be that complicated.

1 Like