Hello,
I am asking as a newbie.
I have two kinds of log type. One type gives me ID's of items along with
other information. The other type gives me a particular id and its relevant
information such as its name and so on.
I want to perform a search and perform an update on the first type of log
such that the item's other information (name and so on) can be added to
that log line based on the matching Id.
As an example =>
First Type:
{
- "_index": "logstash-2014.10.19",
- "_type": "logs",
- "_id": "VRh2iqsiRMmgS87BEIuduA",
- "_version": 1,
- "_score": 1,
- "_source": {
- "@timestamp": "2014-10-19T22:12:30.470Z",
- "message": "18 Oct 2014 02:21:48,640 DEBUG [http-8080-1]
(com.rtx.db.Where:45) -
[2459BC896ECDFF92E85797F84E9DFCB4][page4][pwu2]EmptyPolicyApplicable =
false ",
- "@version": "1",
- "host": "kilsedar-N55SL",
- "path": [
- "/home/kilsedar/Downloads/RTX.log",
- "com.rtx.db.Where:45"
],
- "tags": [
- "_xmlparsefailure",
- "LogData"
],
- "day": "18",
- "month": "Oct",
- "year": "2014",
- "time": "02:21:48,640",
- "mode": "DEBUG",
- "httpPort": "http-8080-1",
- "sessionId": "2459BC896ECDFF92E85797F84E9DFCB4",
- "pageId": "page4",
- "Info": "EmptyPolicyApplicable = false ",
- "pwuId": "pwu2"
}
}
Second Type:
{
- "_index": "logstash-2014.10.19",
- "_type": "logs",
- "_id": "LqDWHES9S1qS2WBYxq9fRA",
- "_version": 1,
- "_score": 1,
- "_source": {
- "@timestamp": "2014-10-19T22:12:20.322Z",
- "message": " <PowerIndexUnit id="sv1#area10#page4#pwu2"
name="Product List" linkOrder="sv1#area10#page4#pwu2#ln24"
customDescriptor="false" gr:x="75" gr:y="105" sortable="true"
checkable="false" useCountQuery="false" entity="pkg1#ent8"
displayAttributes="pkg1#ent8#att48 pkg1#ent8#att39 pkg1#ent8#att41
pkg1#ent8#att42" distinct="false" blockFactor="10" blockWindow="1">
<Selector id="sv1#area10#page4#pwu2#su5" defaultPolicy="fill"
booleanOperator="and"> <AttributesCondition
id="sv1#area10#page4#pwu2#su5#acond2" name="Name" predicate="contains"
booleanOperator="or" implied="true" ignoreCase="false"
attributes="pkg1#ent8#att41"/> <AttributesCondition
id="sv1#area10#page4#pwu2#su5#acond5" name="Price" predicate="eq"
booleanOperator="or" implied="true" attributes="pkg1#ent8#att42"/>
<RelationshipRoleCondition id="sv1#area10#page4#pwu2#su5#rcond3"
name="Category" predicate="in" implied="true" role="rel12#rel7"/>
</Selector> <VRules> <CheckedUnitItemsValidationRule
id="sv1#area10#page4#pwu2#ckd4" name="Validate Items Number"
predicate="min" itemCount="1"/> </VRules> <Link
id="sv1#area10#page4#pwu2#ln24" name="Details" to="sv1#area10#miu6"
type="normal" validate="true" ajaxEnabled="false" ajaxOpenWindow="true"
ajaxWindowUseTitle="true" ajaxWindowResizable="true"
ajaxWindowAutoResizing="true" ajaxWindowClosable="true"
ajaxWindowDraggable="false" ajaxWindowModal="true"
ajaxOpenWaitingDialog="false" ajaxReplaceWindow="false"
ajaxWindowTitle="Product Details"> <LinkParameter
id="sv1#area10#page4#pwu2#ln24#par57" name="Product Key"
source="data[].pkg1#ent8#att38"
target="sv1#area10#miu6.mov1#mpkg2#hym6#icu7#icp5"/> </Link>
<SortAttribute
attribute="pkg1#ent8#att48" order="ascending"/> <SortAttribute
attribute="pkg1#ent8#att39" order="ascending"/> <SortAttribute
attribute="pkg1#ent8#att41" order="ascending"/> <SortAttribute
attribute="pkg1#ent8#att42" order="ascending"/> <DefaultSortAttribute
attribute="pkg1#ent8#att48" order="ascending"/> <DefaultSortAttribute
attribute="pkg1#ent8#att39" order="ascending"/> <DefaultSortAttribute
attribute="pkg1#ent8#att41" order="ascending"/> <DefaultSortAttribute
attribute="pkg1#ent8#att42" order="ascending"/> </PowerIndexUnit> ",
- "@version": "1",
- "tags": [
- "multiline",
- "_xmlparsefailure",
- "_grokparsefailure",
- "WebModel"
],
- "host": "kilsedar-N55SL",
- "path":"/home/kilsedar/Downloads/WebModel/sv1/area10/page4.wr",
- "powerIndexUnitId": [
- "sv1#area10#page4#pwu2"
],
- "powerIndexUnitName": [
- "Product List"
],
- "powerIndexUnitEntityId": [
- "pkg1#ent8"
]
}
}
So in this case I want to add powerIndexUnitName and powerIndexUnitEntityId
to the first Log as new fields.
Would it be possible and what kind of approach would you suggest?
Thank you!
--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/1aaad945-37a4-4764-97b5-49835eb9869e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
