Correlate field

Elastic Stack Elasticsearch
1

Hello,

Sorry if my question is a bit easy, but I didn't find any way to do this request, and I am getting to wonder if it's really possible ...

Init

PUT /test-index
PUT /test-index/user/1
{
"name": "John",
"connID": "44"
}
PUT /test-index/connection/1
{
"connID": "44",
"ip_source": "8.8.8.8"
}

Search

I would like to write a request to return:

  • "John" : "8.8.8.8"

This little test is actually to correlate real data log from python app and firewalls logs.

Thank you for you help.

2

Joins are not supported in elasticsearch unless you are using parent/child feature.

A better approach is to create a flat document containing all that info.

3

Thank you David for you reply.

Do you know if joins are not supported by conception/design, or if it is plan to implement this feature in future ?

Does this means there is no way to do logs correlation on the fly (I mean post-indexation) with ELK ?
(I push logs from filebeat directly to ES)

Thank you.

4

By design. You can see a whole discussion here:

If you want to do something like this without pre-processing your data or without paren/child feature, you can have a look at the Graph feature available in X-Pack (commercial licence).

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.