# Is cross document query possible?

**URL:** <https://discuss.elastic.co/t/is-cross-document-query-possible/68403>\
**Category:** Elasticsearch\
**Created:** [December 8, 2016, 8:36am UTC](https://discuss.elastic.co/t/is-cross-document-query-possible/68403 "2016-12-08T08:36:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gilisade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gilisade/32/98740_2.png) [@gilisade](https://discuss.elastic.co/u/gilisade)\
**Post date:** [December 8, 2016, 8:36am UTC](https://discuss.elastic.co/t/is-cross-document-query-possible/68403/1 "2016-12-08T08:36:40Z")

</div>

Hi  
i have an index called X  
in that index i have 1 document type  
and the documents are separated by the filed "type" (added by logstash)  
one type is called : type1  
and one type is called : type2  
both have one field that is the same called "identifier"  
that means that some documents from type1 have the "identifier" field with the same value as documents from type 2  
i want to search for a string in a field called msg in documents from type1 , and get the documents from type2 that contain the same value of "identifier" (from the results of the string search in field msg)

is that possible with elasticsearch?

---

<div class="post-metadata">

**Author:** ![gilisade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gilisade/32/98740_2.png) [@gilisade](https://discuss.elastic.co/u/gilisade)\
**Post date:** [December 8, 2016, 8:49am UTC](https://discuss.elastic.co/t/is-cross-document-query-possible/68403/2 "2016-12-08T08:49:11Z")

</div>

for example :  
this is a type1 document :

```
{
  "_index": "X",
  "_type": "type",
  "_id": "ID",
  "_score": null,
  "_source": {
    "msg": "stringsstringsstrings",
    "@timestamp": "2016-12-08T08:23:35.000Z",
    "logexpirydate": "2016-12-09T08:23:46.341Z",
    "identifier": "XYZ",
    "@version": "1",
    "type": "type1"
}

```

}

and this is a type 2 document:

```
{
  "_index": "X",
  "_type": "type",
  "_id": "ID",
  "_score": null,
  "_source": {
    "severity": "Info",
    "identifier": "XYZ",
    "module": "some module",
    "type": "type2",
    "tags": [],
    "exception_data": "",
    "@timestamp": "2016-12-08T08:38:46.235Z",
    "@version": "1",
    "methodname": null
  }

```

i want to search for a certain string in type1 filed "msg" - and use the "identifier" field value to get type2 document containing the same "identifier" field value

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 8, 2016, 8:53am UTC](https://discuss.elastic.co/t/is-cross-document-query-possible/68403/3 "2016-12-08T08:53:08Z")

</div>

So basically a JOIN?

It's not really doable. You can have a look at parent/child feature though which can help you may be in such a case. It comes with a cost (memory usage as we have to perform joins in memory).

---

<div class="post-metadata">

**Author:** ![gilisade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gilisade/32/98740_2.png) [@gilisade](https://discuss.elastic.co/u/gilisade)\
**Post date:** [December 8, 2016, 8:58am UTC](https://discuss.elastic.co/t/is-cross-document-query-possible/68403/4 "2016-12-08T08:58:40Z")

</div>

Yes i guess something like a join  
i looked at the parent child option but i don't quit know how to "tell" elasticsearch who is the parent and who is the child  
the data comes from JDBC input with logstash  
and what connects the 2 documents is the "identifier" filed  
so how can i tell logstash that when a document from type1 has "identifier" : "XYZ" it is a child of a document from type 2 with "identifier" : "XYZ"?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 8, 2016, 3:45pm UTC](https://discuss.elastic.co/t/is-cross-document-query-possible/68403/5 "2016-12-08T15:45:27Z")

</div>

May be this can help you?

> [@Define Parent-Child Relationship in Logstash](https://discuss.elastic.co/t/define-parent-child-relationship-in-logstash/51467):
>
> Hi, According to [https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/129](https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/129), this seems possible to do now. I'm trying to index two different sources (2 sql tables), and then correlate a parent-child relationship between them. Currently, ingesting data is perfectly fine. However, I'm really confused how to create the parent-child relationship within logstash... I actually can't even figure out how to do it using POST requests in elastic's examples found here: [https://www.el…](https://www.elastic.co/guide/en/elasticsearch/guide/current/parent-child-mapping.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 5, 2017, 3:46pm UTC](https://discuss.elastic.co/t/is-cross-document-query-possible/68403/6 "2017-01-05T15:46:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.