Elasticsearch parent child mergin two tables together

Elastic Stack Elasticsearch
1

How do I do something like a JOIN in elasticsearch. I have 2 index

"_index": "blacklist1", "_type": "logs", "_id": "KS8CI-XKSID8DKSLAKS"

"_index": "raw_firewall_logs", "_type": "logs", "_id": "SADLFSJFOI3098WOIJFD",

Assuming in "raw_firewall_logs" I have a field "source_ip" that contains "123.123.123.1"

Assuming in "blacklist1" I have a field "block_ip" that contains "123.123.123.1" and a field "threat_type" containing "worm"

How should I update my mapping and how should I query so that I can see the following

{"source_ip": "123.123.123.1", "blacklist1": "Yes", "blacklist1": "worm"}

2

You need to do this at index time, you cannot join like this.

3

Can I know what is index time?

4

When you send the data to ES to be stored.

5

Do you have any examples on one index joining with other indexes at index time?

6

I would recommend reading the section on data modelling from the Definitive Guide. For many use cases the best way is to simply denormalise the data prior to indexing it into Elasticsearch.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.