Cross-indexd fitering using Kibana in v5.6.1

Elastic Stack Kibana
1

Hi,

Currently we have our data saved in elasticsearch version 5.6.1, by using one index with several types in it, and with parent-child reltaions.

This approach allows us in Kibana to make queries and filters easily in a single dashboard, since all the data is in one index.

This will not be supported in next versions of elastic :expressionless:.

To my understanding from other posts, if we are to re-arrange our data in elastic, in a way that each type is an index - we will lose the ability to keep using the Kibana the way we currently use it (by applying a filter to the parent we change the output of all its children).

One option would be to create an index for each child-type, do not use the parent-child paradigm, and each document would have additional properties that were in the parent before this change, so we could make the same queries.

Is that a good approach when thinking big-data wise?

Thanks,

2

Hey @alonguterman1, great question!

When it comes to migrating away from multiple types in the same index, there are a few alternatives (borrowed from this blogpost)

Using a single index per type
Collapsing all properties under a single type
Creating a custom type field, and nesting all types under a single type.

Since you are currently using a parent/child relationship currently, you won't want to use the "single index per type" option, but that still leaves us with the latter 2 solutions, either of which should work with the new
join datatype that is essentially a typeless parent/child.

3

Thanks :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.