Join between two indices is possible in elasticsearch

[Hendrik_Muhs]

in addition to the already given answers, I like to mention another possibility: You could "join" 2 indices using transform and create a new index which has the data of both. Scripting give you a lot of flexibility to do this.

2 related posts:

Is is possible to partially update a dest doc with transforms?

Hi, a transform can have multiple sources and they do not need a common schema as long as the field name of the group_by is compatible. So if you have for example a field "customer_id" in both indices "past_purchases" and "predicted_purchases" you can create a transform that joins over both indices: PUT _transform/prediction_accuracy { "source": { "index": ["past_purchases", "predicted_purchases"] }, "pivot": { "group_by": { "id": {"terms": { "field": "customer_id" …

How to aggregate data on elastic sent by logstash

Hi, you should be able to do this using transform (see https://www.elastic.co/guide/en/elasticsearch/reference/7.4/put-transform.html). The workflow would look like this: you index the data into elasticsearch as single docs, this is the "source" index you create a transform that pulls data from the "source" and aggregates it according to your needs into a "dest" index. In your case you would group by entity Id, firm id, etc. and define aggregations, e.g. lastUpdated would be a max aggregatio…

It depends on what you want to do. We do not have the classical database join but we might be able to solve you usecase in a different way.

Maybe you can describe what you want to do?