|
If I have data and I want to anonymize a part of an event (extracted field, let's say user), I want to keep the original events in indexA and the anonymized events in indexB.
|
2 Answers:
|
Starlette, Collecting both original and anonymized events in separate index would effectively double licensing for those particular events. There is nothing I am aware of that would let you index only anonymized parts and reconstruct at search time. |
|
Oke just wanted to make sure,,,( I hoped that you could also extracted a unique id and use this with a specific search/transaction) so lets say that I cut the user part, and only index that one to indexB, and reconstruct this with searches over indexa en indexb on _time and "someid" |