Elasticsearch lookup email from different index

PUT audit/doc
{
"userid": "some_guid",
"operation": "performed action a"
}

PUT audit/doc
{
"userid": "some_guid",
"operation": "performed action b"
}
PUT audit/doc
{
"userid": "some_guid",
"operation": "performed action c"
}
PUT user/doc
{
"userid": "some_guid",
"name": "someone",
"email": "someone@abc.com"
}

we have tons of records like above in user and audit table. i would like to create a report and return user with email someone@abc.com performed operation a, operation b, operation c. and same for all other users. how can we do this easily with elasitcsearch. my audit table is not flexible, but i can reindex my users table in different format to make it easier

You cannot join the data of two indices at query time. However you could try to do that during index time using the enrich processor, see Enrich processor | Elasticsearch Guide [7.13] | Elastic

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.