Correlate field

(John Marcou) #1


Sorry if my question is a bit easy, but I didn't find any way to do this request, and I am getting to wonder if it's really possible ...


PUT /test-index
PUT /test-index/user/1
"name": "John",
"connID": "44"
PUT /test-index/connection/1
"connID": "44",
"ip_source": ""


I would like to write a request to return:

  • "John" : ""

This little test is actually to correlate real data log from python app and firewalls logs.

Thank you for you help.

(David Pilato) #2

Joins are not supported in elasticsearch unless you are using parent/child feature.

A better approach is to create a flat document containing all that info.

(John Marcou) #3

Thank you David for you reply.

Do you know if joins are not supported by conception/design, or if it is plan to implement this feature in future ?

Does this means there is no way to do logs correlation on the fly (I mean post-indexation) with ELK ?
(I push logs from filebeat directly to ES)

Thank you.

(David Pilato) #4

By design. You can see a whole discussion here:

If you want to do something like this without pre-processing your data or without paren/child feature, you can have a look at the Graph feature available in X-Pack (commercial licence).

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.