Combining 2 index to visualize data in Kibana

[Sam12]

Hello Everyone,

I have 2 index with same field as _id in Kibana and I want to visualize data from both index. Using _all and index-* i can see all the data fields but when I select fields for visualize it just says No Results found. Please advise on how it can be resolved

[thomasneirynck]

hi @Sam12,

so you have a single index pattern that catches both indices?

For the no-results, can you verify the following:

• there's data in the time-range you selected
• check the index-pattern in Discover. does it show an overview of the data?

[Sam12]

Hi @thomasneirynck

Thank you for your quick response. So basically I have 2 index patterns abc which is having 5000 docs and abcdef is having 7000 docs. Now for both the index pattern the _id is having same data. Now when using combine both of them in index pattern like abc* i am getting all the fields in one index pattern so the hits now it is showing is sum of two i.e. 12000 docs. Now when i am trying to visualize abc* index pattern and selecting field from individual index it is showing me No Results. Further below is the answer to your query
there's data in the time-range you selected : So basically i am not filtering data based on timestamp i am trying to visualize data based on the common field between both
check the index-pattern in Discover. does it show an overview of the data? _Index in Discover for this combined index pattern shows me both index patterns below it. But there is one strange thing i am seeing there so in the Available fields it is just showing me fields of abc and when i apply filter like _index is not abc than it shows me the fields of abcdef.

[thomasneirynck]

hi @Sam12,

are the mappings of both indices abc and abcdef the same? In other words, do they have the same fields, and if they do, do they share the same data-types?

[Sam12]

Hi @thomasneirynck
So the mapping is different in both indices but they are mapped to same _id field i mean the field _id is mapped to same data like _id appears same in both data. They share same data just fields that they are mapped to are different. _id has same values in both index patterns though it is coming from different logs but the data that appears is in similar fashion like if you search for the data in that field it will appear in both the tables.