DataTable with two different indices

Elastic Stack Kibana
1

I have documents in two different indices that relate to each other. Each document has a unique ID field that matches one or more documents in the other index.

I am trying to build a visualization (datatable) that displays the following (most are strings and one date):

IndexA.Field -- IndexA.Field2 – IndexB.Field4 – IndexB.Field5 – [UniqueID]

The indices are named so that I can reference both within the same Kibana index pattern.

Is this possible? If so, how?

My situation is similar to this one: Datatable from two different documents but one common field

I just want to confirm that there is no other workaround other than merging the data before sending to ES...

Thanks,

2

Hi Josh,

Kibana only leverages the search features of Elasticsearch, which is designed for many things, but primarily fast search retrieval of data and filtering metric data in logs. It doesn't have foreign key / join support. When it's been brought up before, it's been seen as a very hard to scale feature. It would be susceptible to memory limits that would be too limited for medium or large scale deployment, and take away from the overall value that Elasticsearch gives.

The way to get the visualization you need will be to have a middleware that merges the data before it gets indexed.

Hope this helps,
-Tim

3

Thanks @tsullivan for confirming, much appreciated.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.