Combining two fields from tow different documents within the same index based on conditions

Elastic Stack Elasticsearch
1

I am having data as below in one of the index
@timestamp instance_name dskIndex dskPercent dskPath
Sep 8, 2023 @ 21:45:27.332 ssc-b 3 - /disk0.7
Sep 8, 2023 @ 21:45:27.332 ssc-b 3 22 -

I want the instance_name & dskIndex in both messages to be matched, then the dskPath & dskPercent fields displayed so it shows what the partition is called & how full it is in a percentage.

how to achieve this using elasticsearch(dynamically when new values comes) ?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.