Aggregate docs to present a single constructed visualization

I'm reading in a log that records meeting metadata. It has all sorts of stuff, but I only care about two things. Something like this:

2018-05-04 14:50:01 eventType=MeetingStartedEvent meetingID=1234 eventTime=14:48:00
2018-05-04 14:56:45 eventType=MeetingEndedEvent meetingID=1234 eventTime=14:49:37

So I've constructed a query that grabs only the data I need:

eventType:"MeetingStartedEvent" OR eventType:"MeetingEndedEvent"

The only thing that seems like it might work is Data Table. My metric is useless, but at least I can use term aggregation to get buckets of 2 items each based on the meetingID. Problem is now I have no idea how to get from there to a unified presentation of the data. Something like this:

MeetingID StartTime EndTime

I've read up on scripted indexes and that doesn't seem like it will solve my problem. Is this even possible?

There is no way to join documents in Elasticsearch. How are the documents getting added to Elasticsearch? Maybe that process could do the join and only write a single document per meeting?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.