I would like to have name and age on the root of the document. Setting the name to “” in a starlark script triggers an error. Is there any way to make this happen?
_source is what Elastic/opensearch received, so that’s basically the root. I would like to shape the document in such a way that tag/host is directly under the root (in this representation under _source) without the measurement_name.
This would give us the flexibility to transform the documents to fit in our own opensearch cluster (output plugin still missing btw), but with another telegraf instance to transform them to fit the needs of our Security Operations Center partner. So this is less about metrics (our usual use case for Telegraf), but still Telegraf could be very useful (thus dropping logstash that’s treating opensearch as a second class citizen).