Z names with an elastic index

Elastic Stack Elasticsearch
1

I support an environment similar to AWS where the server names are of limited(/no) value in their raw form, so we have aliased them such that they are meaningful. If the server were rebuilt the zname would change, but the alias not.

I require all data captured in elastic to reference the alias and not the zname.

What do I need to do to make that happen?

2

You'd need to make your ingest process use it.

3

Sorry, are you able to explain what you mean by "make your ingest process use it"? Thanks

4

You'd have to create something to do the rename as you index the data into Elasticsearch.
So an ingest pipeline, Logstash, something custom.

5

We may have found a way, in that we have defined a host friendly name in the metric beats config, which seems to be appended to all the indexes, so we just need to make sure that that variable is visualised when building visualisations.

This is hopefully simpler than building out some code to rename content on the fly.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.