Elasticsearch: creating inner queries

Elastic Stack Elasticsearch
1

here are my logs:

index: purchase

{details: { name: john, corID: 12345678 }}
{details: { name: bill, corID: 96657545}}

{town: NY, ID: 12345678 }
{a:b , v: g}
{a: hi, b: 12345678}
{g:f , k:ggg777 }

I would like to create a query which for a given name, the query will search in purchase index for details.name=<name> , extract details.corID and search in the indexe for logs which contain the details.corID

example for above details:

name = "john"

query result:
(all logs which have 12345678)

{details: { name: john, corID: 12345678 }}
{town: NY, ID: 12345678 }
{a: hi, b: 12345678}

this is how I would do it in SQL:

SELECT * FROM purchase
where  corID= 
     (SELECT details.corID 
      FROM [purchase]
      where  details.name = "john")
2

This is a join, and Elasticsearch does not support joins in general.

One workaround would be to use the parent/child feature in order to index the cor as a parent document and then use has_child/has_parent to join documents with their corID. But beware that parent/child joins come with a significant performance penalty.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.