"unknown field [pivot]" error

[meatwad]

Hi there,

I’m trying to follow along with this post to try and enrich FortiGate logs:

Best practice for adding additional fields to transform

Hi community, I've created a custom transform job to extract Fortigate VPN events into custom index to get start / stop time. Sharing it below for reference. This is extracting data from fortigate integration so we already have the geo fields in the source data. I'm wondering that is the best practice for adding geoip fields to the data for client.ip? Is it recommended to add a new custom ingest pipeline that uses geoip processor on the client.ip field? PUT _transform/fortivpntunnels/_update…

But when I do the initial POST _transform/fortivpntunnels/_update, I get the following error:

{
  "error": {
    "root_cause": [
      {
        "type": "x_content_parse_exception",
        "reason": "[92:3] [data_frame_transform_config_update] unknown field [pivot]"
      }
    ],
    "type": "x_content_parse_exception",
    "reason": "[92:3] [data_frame_transform_config_update] unknown field [pivot]"
  },
  "status": 400
}

Is there something that needs enabling in my 8.14.2 install or what exactly do I need to do? Sorry for the stupid question but I appreciate the assistance!

[Tortoise]

Hello @meatwad

As per documentation below is used to update a transform :

POST/_transform/{transform_id}/_update

Update a transform | Elasticsearch API documentation

To create a transform we will have to use 
PUT _transform/fortivpntunnels
{
}

When you want to update the transform we use _update
POST _transform/fortivpntunnels/_update
{
}

But in this he has not used pivot field to update existing fields :

POST _transform/fortivpntunnels/_update
{
  "dest": {
    "index": "fortinet-vpn-tunnels",
    "pipeline": "add-client-geo"
  }
}

Thanks!!