Can we join two index fields in one index

Hi All,

ELK 5.5

We are having two index of different logs (haproxy-index and fuselog-index).
Both index having different grok pattern.
but in haproxy grok pattern having three fields

FuseLog grok pattern

But grok pattern having same col1-ID field.
Is it possible to join fields of two index in one index? as mention in below example

FYI we’ve renamed ELK to the Elastic Stack, otherwise Beats feels left out :wink:

No it is not, it's not possible to joins in Elasticsearch at all.

So can you give any other idea to solve it?

What is the problem you are trying to solve?

I have to monitor 200,500,502,504 response code from haproxy log. Based on i have to define fuse log pattern. So that i can easily rectify where the 200,500,502,504 response occur.
I hope it is clear.

That can be handled by grok.

Thanks for share you input.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.