Hi Everyone,
I'm looking for a way (best practice) to implement a sort of join or lookup of different IDs in Kibana visualizations.
Basically, using ELK we will send events with certain fields, such as IDs for categories, clients, etc. These are stored in other indices, which could be used for lookup...
The idea is that instead of showing
User ID - count(xxx)
I wanted my users to see another field, such as the User name, or something, instead of the id.
I have researched abt the different join options in ES and below are my comments for each strategy. Please do correct me or point me in the correct direciton if i'm missing something?
Application join - this is pretty much the best solution/only solution? However the "application" in this case is Kibana, so how do I implement? A last resort option would be a ES proxy that finds some "known" fields in the kibana query, and replaces it with a lookup of that field to the desired "label" field (such as UserID->UserFirstName+UserLastName for example.)
Parent/Child - this would work as the entire log entry would need to be a child of a single parent. In our case we need to have parents of different types, for example a User parent, a Category parent, etc.
Denormalization - store the name of the user inside each log event or the category name inside each log event would work until there is an update to a field which is used for exhibition...
Nested Documents - not really useful as it would require storing the entire content of the user inside each log, or every log inside each user, which would pose a problem because we have Categories, and other dimensions which are N-to-N... (even if each even has only 1 user, 1 category, etc).
I'm at a loss for the best option here... I'm pretty much settled that I'll need to go from "Names" to IDs prior to conducting the search, and from IDs to names after the search. This is doable app-side, but I cant see how to implement this in Kibana. Any experience or ideas greatly appreciated!
