Transform -> Field Extraction Example to GroupBy

Under a transform query one of the results I get is this key value pair

:"request_User-Agent": "idType=drwet; rmtSVer=; wqHVer=; idName=swawsw; idRolt=2.85T",

I would like to "group_by" stbName .

Could someone show an example about how to extract the key:value of idName . So I can group by idName ?

Thanks in advance!

Is request_User-Agent one of the fields in your source index (i.e. the index you provide as an input to the transform)?
If so, then you can configure a runtime field idName which will be computed with a script. The script will extract the swawsw string from the request_User-Agent field.

Here is the relevant portion of the transform's config:

PUT _transform/transform-by-id
  "source": {
    "index": ["source-index"],
    "runtime_mappings": {
      "idName": {
        "type": "keyword",

Thanks for the example. It works as intended.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.