# ECS and normalizing queries across indexes **URL:** \ **Category:** Elasticsearch\ **Created:** [October 23, 2018, 7:43am UTC](https://discuss.elastic.co/t/ecs-and-normalizing-queries-across-indexes/153536 "2018-10-23T07:43:05Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![dss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dss/32/33128_2.png) [@dss](https://discuss.elastic.co/u/dss)\ **Post date:** [October 23, 2018, 7:43am UTC](https://discuss.elastic.co/t/ecs-and-normalizing-queries-across-indexes/153536/1 "2018-10-23T07:43:05Z")
Elasticsearch 6.3.2 [Elastic Common Schema](https://github.com/elastic/ecs) notes: > A common schema helps you correlate data from sources like logs and metrics or IT operations analytics and security analytics. Assuming a case where a common schema is used to normalize field names across a broadly disparate set of indices for log data, and wanting to run queries which correlate events based on a common field name in several of these unrelated indices at once, how can that be done? For example: a query designed to match events where the same _user.name_ was logged in an index containing proxy server logs as the authenticated user and an index containing antivirus or similar endpoint logs where the user executed a malicious file within the same period of time. Looking at approaches like [these joins](https://www.elastic.co/guide/en/elasticsearch/reference/current/joining-queries.html) it seems like the intention is correlating documents within the same index. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 20, 2018, 7:43am UTC](https://discuss.elastic.co/t/ecs-and-normalizing-queries-across-indexes/153536/2 "2018-11-20T07:43:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.