What version are you on?
There are a number of ways to do this but if you just want to see this in Kibana Visualizations and dashboards the easiest way is to add a runtime field to the the Index Pattern / Data View
(you could add it to the actual mapping at some point if you want) Read on runtime fields
Go To Stack Management -> Index / Pattern or Data View depending on the version
Add Field
Here is the sample code...replace with your field names etc...
def status = doc['snmp_status'].value;
if (status != null ) {
if (status == 1 ) {
emit ("open");
return;
}
else {
emit ("closed");
return;
}
}
emit("Unknown");
Discover ... and it will work in other Visulazations like Lens etc.
