Update values based on previous documents

Hey Everyone!

So I am very new to the elastic stack and am currently working on my first application using it. I have data that comes from different files via filebeat. They then go through logstash to parse out the fields of the document. The problem is that some messages have different data compared to each other. For example:

doc1
{
"latitute": 20
"longitude": 30
}

doc2
{
"level": "Error"
}

However, I want to visualize the data via Kibana using a map. and I need the data from Doc1 and Doc2. Is there a way to use a script to access the data from Doc1 to update Doc2? I would prefer not to create additional documents if that is possible. Thanks for the help!

Hi,

Yes you can use aggregation filter plugin to aggregate some messages on specified rules.

Hey Tomo,
I decided to work in a different direction as I need to do some more analysis after the collection so I ended up using the python API to pull the data.
Thanks for the help!

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.