Is it possible to fire query in two indices and based on the result update third index?

(Vikas Gopal) #1

Hi Exerts,

I have 3 indices

student (name=vg, gopal etc)
teacher (teachername=robert, bob etc)
Class (classname=maths, english etc)

What I want is to check student and teacher indices and based on a condition results I want to update school index
something like if name=vg , teachername= robert then class=maths should be updater in Class index. This should be an automated process , so when data get into student , teacher index class modify accordingly ?


(David Pilato) #2

No you can't do that.

What are you trying to do exactly? I mean: don't speak about the implementation but only the use case.

(Vikas Gopal) #3

Well , I have antivirus data , vulnerability data and Configuration data (cmdb) . Here requirement is if system affected with virus , also it is vulnerable then cmdb index should get update like it is critical system/machine .Second scenario would be if machines is affected but not vulnerable then it is low critical and so on..

(Mark Walkom) #4

We recommend doing that at ingest time.

Take the event, look in the AV index, then the vulnerability index, then the CMDB index and add things to the original event accordingly.

(Vikas Gopal) #5

This is what my plan is , thanks Mark

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.