I am using ITSI grouping feature where we need to match the eventid from the two indexes of ITSI, index=itsinotableaudit and index=itsitrackedalerts. The issue is that itsinotableaudit index is taking the group id ( which groups similar events) as eventid whereas itsitracked_alerts is taking eventid of every event not by group.
Now I want to compare the event_id from both the indexes but i cant do so because of itsi grouping. Please help/advice.
The field "eventid" is mostly used for the notable events, in the itsitrackedalerts field.
but in versions older than 3.* it was also used for the group id in the index=itsigroupedalerts, and since 4.* for the Episodes ids too.
This can be confusions, as there is also an itsigroup_id field and when you use the API, the id may be referring to the notable or to the group...
The best way to avoid confusion is to do an eval or a rename to create a second field group_id to avoid confusion, depending of the context of the data.