# JOIN different data sources **URL:** \ **Category:** Logstash\ **Created:** [April 15, 2016, 8:34am UTC](https://discuss.elastic.co/t/join-different-data-sources/47480 "2016-04-15T08:34:48Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![veve90](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/veve90/32/6517_2.png) [@veve90](https://discuss.elastic.co/u/veve90)\ **Post date:** [April 15, 2016, 8:34am UTC](https://discuss.elastic.co/t/join-different-data-sources/47480/1 "2016-04-15T08:34:48Z")
Hello, I wonder, if there is a way to join data that I'm currently receiving (in real time) with existing data (in elasticsearch). If yes, could you point me to how to do it? Thank you! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 17, 2016, 6:10am UTC](https://discuss.elastic.co/t/join-different-data-sources/47480/2 "2016-04-17T06:10:34Z")
Join, no. But you can look it up [https://www.elastic.co/guide/en/logstash/current/plugins-filters-elasticsearch.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elasticsearch.html) and then do stuff. ---
**Author:** ![veve90](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/veve90/32/6517_2.png) [@veve90](https://discuss.elastic.co/u/veve90)\ **Post date:** [April 23, 2016, 4:13pm UTC](https://discuss.elastic.co/t/join-different-data-sources/47480/3 "2016-04-23T16:13:14Z")
It is kind of unclear. The filter is appling only on the current message if I understand it well. So can a filter help me filter on existing data? In fact I'm receving actions/events done by users (I have their userid) and I would like to know who is the user (I have an account table). Thank you! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 23, 2016, 9:09pm UTC](https://discuss.elastic.co/t/join-different-data-sources/47480/4 "2016-04-23T21:09:25Z")
> [@veve90](#): > > It is kind of unclear. The filter is appling only on the current message if I understand it well. So can a filter help me filter on existing data? No, you need to reindex that. ---
**Author:** ![veve90](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/veve90/32/6517_2.png) [@veve90](https://discuss.elastic.co/u/veve90)\ **Post date:** [April 23, 2016, 9:21pm UTC](https://discuss.elastic.co/t/join-different-data-sources/47480/5 "2016-04-23T21:21:52Z")
Apologies, I'm still learning.. I cannot understant , event if I reindex everything, how can the filter help me? I will hot have the account message and the account action message in the same time... Thank you! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 23, 2016, 10:45pm UTC](https://discuss.elastic.co/t/join-different-data-sources/47480/6 "2016-04-23T22:45:34Z")
If you have data in ES in an index that you want to enrich other incoming events with, then you need to use the filter I linked to to read that data that is in ES to then do something with. If you have older data that you want to do this enrichment on, you need to reindex it through Logstash. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/join-different-data-sources/47480/7 "2017-07-06T05:01:01Z")