Entity centric indices

Elastic Stack Elasticsearch
1

Hey there,

I want to create a funnel report of my user journey and want to track the ratio of registered users vs. users that logged in and users that created an order.
To do so I want to use entity centric indices as described here.

How do I transform my event centric data to entity centric data? I've thought of writing a microservice polling Elasticsearch with periodic GET requests to build user documents and POST them back to a new index. But this seems to be an inelegant solution considering the sample (bit.ly/entcent) code of python and groovy scripts. Does this work for periodic data, too, or do I need to have all the samples in one batch? Is there a way to listen for new log documents and to add them to the entity centric index?

Thanks for any clarification,
Florian

2

Yes. An incremental update script would be one where you simply query for events added since the last time you ran the script using an appropriate date filter.