1 year ago
#382981
Aleksander Chubarov
How to enrich documents in index in kibana/opensearch?
Let's say I have pretty simple event-centric index:
{
event: 'name',
timestamp: 12345,
user: 'some-id'
}
I have "registration" event, and want to enrich all events from this user with registration date. What's the easiest way to achieve it? I bet I can do it somehow with help of transform API, but my best shot is to have entity-centric index of "users" like this:
{
user: 'some-id',
events: [...]
}
But then I will lose an ability to visualize, because I'll basically lose time field of my original index
opensearch
opensearch-dashboards
0 Answers
Your Answer