# How to link two indices?

**URL:** https://discuss.elastic.co/t/how-to-link-two-indices/37747
**Category:** Elasticsearch
**Created:** [December 22, 2015, 11:05am UTC](https://discuss.elastic.co/t/how-to-link-two-indices/37747 "2015-12-22T11:05:34Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![xionglingfeng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xionglingfeng/32/6785_2.png) [@xionglingfeng](https://discuss.elastic.co/u/xionglingfeng)
#### Post date: [December 22, 2015, 11:05am UTC](https://discuss.elastic.co/t/how-to-link-two-indices/37747/1 "2015-12-22T11:05:34Z")

</div>

Hi all,  
There are two indices in ES, which stored related information.

For example, an index named "logstash-netflow-YYYY-MM-DD" contains field named "netflow.ipv4\_src\_addr" and "netflow.ipv4\_dst\_addr". Another index named "logstash-radius-YYYY-MM-DD" contains field named "Framed-IP-Address" and "User-Name".

Is there anyway to link these two indices together? Like when querying "netflow.ipv4\_dst\_addr=1.1.1.1", shows all corresponding "netflow.ipv4\_src\_addr" and "User-Name"?

If this design is not good, any suggestions to improve it?

---

<div class="post-metadata">

### Author: ![nodexy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nodexy/32/1064_2.png) [@nodexy](https://discuss.elastic.co/u/nodexy)
#### Post date: [December 22, 2015, 2:42pm UTC](https://discuss.elastic.co/t/how-to-link-two-indices/37747/2 "2015-12-22T14:42:42Z")

</div>

Maybe you can try this feature : parent-child relationship

[https://www.elastic.co/guide/en/elasticsearch/guide/current/parent-child.html](https://www.elastic.co/guide/en/elasticsearch/guide/current/parent-child.html)

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 22, 2015, 8:17pm UTC](https://discuss.elastic.co/t/how-to-link-two-indices/37747/3 "2015-12-22T20:17:26Z")

</div>

Short answer is no, you cannot join in nosql systems, including ES.

Longer answer is sort of using something like TimeLion which visually "merges" things. Or you can use parent/child, but it's not really relevant for this dataset.

---

<div class="post-metadata">

### Author: ![xionglingfeng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xionglingfeng/32/6785_2.png) [@xionglingfeng](https://discuss.elastic.co/u/xionglingfeng)
#### Post date: [December 23, 2015, 1:36am UTC](https://discuss.elastic.co/t/how-to-link-two-indices/37747/4 "2015-12-23T01:36:21Z")

</div>

@warkolm Any suggestions to improve my current design to allow such query?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:29pm UTC](https://discuss.elastic.co/t/how-to-link-two-indices/37747/5 "2017-07-05T23:29:10Z")

</div>