How to do summary indexing in Elasticsearch

we have a massive index, few reference indexes and we wanted to summarise from these multiple indexes into a single "summary index" . This way we are planning to join the queries

So the questions

  1. Can output of a GET/POST from elasticsearch be indexed into ElasticSearch (another index)?
  2. Should it be sent to logstash again or is there a method to index without going outside elasticsearch?

Do you mean something like

can the rollup join data from multiple indexes or do we need to individually roll them up?
I'm trying to achieve is a "correlation" of data within multiple indexes by putting into a single summarised index

Elasticsearch cannot join data.

What sort of correlation are you looking at?

I had a complex set of requirement whereby I've to aggregate and then alert based on a dynamic threshold (from a CSV file). So my thought was to put the Dynamic CSV && the summarised raw dataset into a single index and then alert from it.

Ah right, you might be able to use a chained input alert to do this -

1 Like

very interesting. I will have a playaround with it. Meantime, I've upvoted. thanks again mate

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.