Hi,
I have tried via **Transform ** it is looks impossible as span and transaction in same index but different document.
Yes, In ingest pipleline it was possible via enrich processor and enrichment policy but as we have the datastream and we will use index: apm-traces-* in enrichment_policy and it will through the exception of large data - circuit_breaking_exception
If and we can the month or the day in our index-pattern by as traces-apm-{{year}}-{{month}}-{{day}}-* then only enrichment policy will excute and we might get the results.
Have you ever come across with this kind of use case to get one document which merge the fields of 2 different doucments fields from same datastream index via transform or any method?