# Tying an ID back to it's name which resolves in a different log **URL:** \ **Category:** Kibana\ **Created:** [June 10, 2016, 6:55pm UTC](https://discuss.elastic.co/t/tying-an-id-back-to-its-name-which-resolves-in-a-different-log/52472 "2016-06-10T18:55:48Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![seth.yes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seth.yes/32/11788_2.png) [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Post date:** [June 10, 2016, 6:55pm UTC](https://discuss.elastic.co/t/tying-an-id-back-to-its-name-which-resolves-in-a-different-log/52472/1 "2016-06-10T18:55:48Z")
I'm monitoring our Mesos Master for metrics on different Mesos Frameworks. The issue is that the logs which provide metrics for frameworks only provide a numeric ID, such as 20160603-064656-2785394442-5050-26628-2075, whereas in other logs I'm collecting, that data resolves to a name such as 'MesosFramework27', which is the data I need to tie back to. Can anyone give me an idea of where to start to look for a resolution to this? My understanding is that this is doable with an ES front end, but not as straight-forward with a Kibana front end. Any help or guidance is much-appreciated. Running latest stable versions of E, L & K. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 10, 2016, 7:05pm UTC](https://discuss.elastic.co/t/tying-an-id-back-to-its-name-which-resolves-in-a-different-log/52472/2 "2016-06-10T19:05:04Z")
If you know the mapping between IDs and names, you should be able to do the translation in Logstash prior to indexing it into Elasticsearch, possibly by using the [translate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html). ---
**Author:** ![seth.yes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seth.yes/32/11788_2.png) [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Post date:** [June 10, 2016, 7:05pm UTC](https://discuss.elastic.co/t/tying-an-id-back-to-its-name-which-resolves-in-a-different-log/52472/3 "2016-06-10T19:05:31Z")
The problem is they're dynamically generated. Any Framework only lasts an hour or so. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 10, 2016, 7:06pm UTC](https://discuss.elastic.co/t/tying-an-id-back-to-its-name-which-resolves-in-a-different-log/52472/4 "2016-06-10T19:06:50Z")
How do you determine the correct mapping? ---
**Author:** ![seth.yes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seth.yes/32/11788_2.png) [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Post date:** [June 10, 2016, 7:07pm UTC](https://discuss.elastic.co/t/tying-an-id-back-to-its-name-which-resolves-in-a-different-log/52472/5 "2016-06-10T19:07:51Z")
Another log contains that info - similar to [Header] 'FrameworkID' (FrameworkName) [Message] Effectively, Users create a framework with whatever name they want, Mesos automatically creates an indexable key that it references with ~90% of the logs. There are about 50 frameworks at any given time, and plenty of logs do resolve the ID to the Name, I just need to find a way to tie that back in for any message containing the FrameworkID. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:50pm UTC](https://discuss.elastic.co/t/tying-an-id-back-to-its-name-which-resolves-in-a-different-log/52472/6 "2017-07-06T13:50:47Z")