Hi Andreas,
For this sort of analysis it's probably best to combine these two event-centric index contents into a third "entity-centric" index keyed on session ID.
The new dataframes functionality is designed to do the work of fusing the data. You may need to set up an alias that combines the two indices and use that as the source data to perform the transform, using the common session.id field as the join key.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.