How can i enable dynamic scripting in AWS ES?
Building on the other answer where we use logstash to reindex into an AWS ES cluster, you simply need to add one more transformation where # add other transformations here is mentioned.
In your case the input part needs to contain a query for the device:
input { elasticsearch { hosts => ["my-elasticsearch-domain.us-west-2.es.amazonaws.com:80"] index => "my_index" query => '{"query": {"match":{"device": "123"}}}' docinfo => true }}And the filter part would boil down to this, i.e. we rename the @timestamp field and add the Site field:
filter { mutate { remove_field => [ "@version" ] rename => { "@timestamp" => "Time" } add_field => { "Site" => "some value" } }}