Guiding queries that reference fields in the base node

Elastic Stack Kibana
1

Hello,

I'm investigating the use of the graph plugin for causality analysis.

I have a data model containing events with a time, a type and a list of affected items. Now I am looking for affected items in events of type A, which are significantly associated with events of type B affecting the same item occurring within some time span after A.

The guiding query feature seems to fit this use case. The example in the documentation shows how to filter by a global criterion. Is it possible to do something like this:

   ...
   "connections": {
      "query": {
         "bool": {
            "filter": [
               {
                  "range": {
                     "event_time": {
                        "gte": "event_time"
                        "lte": "event_time + 2w"
                     }
                  }
               }
            ]
         }
      }
   ...

Thanks,
Frederik

2

It is currently not possible to take values from the initial results and use them as criteria in a guiding query.
One approach you could consider is to create indexed tokens that represent a combination of an item and a time span eg itemCodePlusWeekNumber. These tokens would allow links to be drawn between incidents on the same items within the same period. It's not as ideal as the syntax you outline but may help get you closer.