I’m trying to take a substring from the “${user.name}” that arrives, and then inflict it on the index.
for example, my users are external, and are constructed through AWS (IAM):
arn:aws:iam::1234567:role/user_admin
this is the value that i get on the ${user.name} field, but i want to parse it and actually take only the “admin” section, and then all my documents will have a relevant field, right now what i’m doing:
{
"match": {
"owned_by": "${user.name}"
}
}
but of course i don’t want to put the entire ARN, maybe perform some kind of regex on that field?