If I have data and I want to anonymize a part of an event (extracted field, let's say user),
I want to keep the original events in indexA and the anonymized events in indexB.
Oke just wanted to make sure,,,( I hoped that you could also extracted a unique id and use this with a specific search/transaction)
so lets say that I cut the user part, and only index that one to indexB, and reconstruct this with searches over indexa en indexb on _time and "someid"
Starlette,
Collecting both original and anonymized events in separate index would effectively double licensing for those particular events. There is nothing I am aware of that would let you index only anonymized parts and reconstruct at search time.