Closed notque closed 3 months ago
In a specific case, we are renaming the id to be project_id now for multiple reasons.
if [target][id] and [target][typeURI] == "data/security/project" { mutate { id => "f06c_move_target_id_to_project_id" add_field => { "[target][project_id]" => "%{[target][id]}" } remove_field => [ "[target][id]" ] } }
This means that we need to make ID omitempty as we remove id when it moves to project_id in cases this occurs.
I can't think of any issues with doing this. If it doesn't exist, it shouldn't be returned.
In a specific case, we are renaming the id to be project_id now for multiple reasons.
This means that we need to make ID omitempty as we remove id when it moves to project_id in cases this occurs.
I can't think of any issues with doing this. If it doesn't exist, it shouldn't be returned.