1 year ago

#382981

test-img

Aleksander Chubarov

How to enrich documents in index in kibana/opensearch?

Let's say I have pretty simple event-centric index:

{
  event: 'name',
  timestamp: 12345,
  user: 'some-id'
}

I have "registration" event, and want to enrich all events from this user with registration date. What's the easiest way to achieve it? I bet I can do it somehow with help of transform API, but my best shot is to have entity-centric index of "users" like this:

{
  user: 'some-id',
  events: [...]
}

But then I will lose an ability to visualize, because I'll basically lose time field of my original index

opensearch

opensearch-dashboards

0 Answers

Your Answer

Accepted video resources