I wanted to ask if it is possible to use Term aggregation on field alias?
We have logs from mutiple sources and I wanted to have a data table visualisation with IP count.
I created an index alias to combine to be able to search in all of them but those fields with IPs have different names per log source, so I was able to get only one field.
Another try was with field alias but it seems those do not work in visualisations...
I am able to search using field alias but in visualisation I get error that this alias field does not match any options.
Is it possible to make an field alias for each of those log sources, then combine them using index alias and then use that in Term aggregation in visualisation? for example data table.