diff --git a/salt/elasticfleet/files/integrations/grid-nodes_general/kratos-logs.json b/salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json
similarity index 52%
rename from salt/elasticfleet/files/integrations/grid-nodes_general/kratos-logs.json
rename to salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json
index 6a67c9c1c..5ae81ba83 100644
--- a/salt/elasticfleet/files/integrations/grid-nodes_general/kratos-logs.json
+++ b/salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json
@@ -1,3 +1,4 @@
+{% set identities = salt['sqlite3.fetch']('/nsm/kratos/db/db.sqlite', 'SELECT id, json_extract(traits, "$.email") as email FROM identities;') %}
 {
   "package": {
     "name": "log",
@@ -19,7 +20,7 @@
             ],
             "data_stream.dataset": "kratos",
             "tags": ["so-kratos"],
-            "processors": "- decode_json_fields:\n    fields: [\"message\"]\n    target: \"\"\n    add_error_key: true      \n- add_fields:\n    target: event\n    fields:\n      category: iam\n      module: kratos",
+            "processors": "- decode_json_fields:\n    fields: [\"message\"]\n    target: \"\"\n    add_error_key: true\n- add_fields:\n    target: event\n    fields:\n      category: iam\n      module: kratos\n- if:\n    has_fields:\n      - identity_id\n  then:{% for id, email in identities %}\n    - if:\n        equals:\n          identity_id: \"{{ id }}\"\n      then:\n        - add_fields:\n            target: ''\n            fields:\n              user.name: \"{{ email }}\"{% endfor %}",
             "custom": "pipeline: kratos"
           }
         }
@@ -28,3 +29,4 @@
   },
   "force": true
 }
+