Dashboards with non-uniform indexes in Kibana

Here's my problem: I have two indexes that share an ID field of the same name and type (source_location), but no other fields:

  • Index M contains the source's metadata (e.g. who created the source, digital signature info, etc..).
  • Index D contains records from the source (e.g. rows in a spreadsheet).

For each M, there may be multiple records in D (one-to-many relationship). What I'm trying to do is, when the user types in a query into the dashboard, the dashboard would first search through D, but then pull out all source_location values found in D and pass those off to a specially designated visualization in the same dashboard that looks them up in M.

So for example, if the user goes to the dashboard and queries query price > 15 and name: Bob, the dashboard would first run that query against index D and update all the relevant visualizations, but then pull out all source_location values from D and pass them off to a specially designated visualization that finds those source_location values in M.

Nested fields may not work here because the amount of nested objects (index D) may far exceed the limits recommended by ES. Denormalization may not work either because the parent object (index M) contains some large values.

What's the correct way to handle this type of dashboard?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.