How to extend what data is published to Elasticsearch

[esilkensen]

Is there a recommended way to extend what data is published to Elasticsearch?

For example, when reporting on processes in Kibana I'd like to include a user's name.  Is there a way to extend JSON such as

{
  "_index": "activiti_tenant_1",
  "_type": "process-instance-activities",
  "_id": "20024",
  "_score": null,
  "_source": {
    "historicActivityEntityId": "20024",
    "timeStamp": 1465242796222,
    "activityId": "sid-96849DA1-3FDE-475E-B31D-6F36BDEA4D27",
    "processDefinitionId": "ElasticsearchProcess:1:20004",
    "processInstanceId": "20020",
    "executionId": "20020",
    "activityName": "Activity 1",
    "tenantId": "tenant_1",
    "startTime": 1465242796222,
    "activityType": "userTask",
    "userId": "1",
    "processDefinitionKey": "ElasticsearchProcess"
  },
  "fields": {
    "timeStamp": [
      1465242796222
    ],
    "startTime": [
      1465242796222
    ]
  },
  "sort": [
    1465242796222
  ]
}‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

so that it includes e.g. a "userName" field instead of only the "userId"?

Thanks in advance for any help!

[gdharley]

Since the Elasticsearch/Lucene event log is populated from the ACT_EVT_LOG table, the easiest thing to do would be overload the AbstractDatabaseEventLoggerEventHandler class (taken from the community engine code) to set a username rather than userid.

This will go into the data element for the event and get parsed in the Elastic event handlers.