Transform -> Field Extraction Example to GroupBy

Elastic Stack Elasticsearch
1

Under a transform query one of the results I get is this key value pair

:"request_User-Agent": "idType=drwet; rmtSVer=2.2.2.4; wqHVer=2.3.2.0; idName=swawsw; idRolt=2.85T",

I would like to "group_by" stbName .

Could someone show an example about how to extract the key:value of idName . So I can group by idName ?

Thanks in advance!
Lp

2

Hi,
Is request_User-Agent one of the fields in your source index (i.e. the index you provide as an input to the transform)?
If so, then you can configure a runtime field idName which will be computed with a script. The script will extract the swawsw string from the request_User-Agent field.

Here is the relevant portion of the transform's config:

PUT _transform/transform-by-id
{
  "source": {
    "index": ["source-index"],
    "runtime_mappings": {
      "idName": {
        "type": "keyword",
        "script": "PLEASE DEVELOP YOUR ID-EXTRACTING SCRIPT HERE"
      }
    }
  },
  ...
}
3

Thanks for the example. It works as intended.