Environment: File Beat (1.0.0-rc2) --> Log Stash (2.1.0)--> Elastic Search (2.1.0)--> Kibana (4.3)
Use Case: Real time application transactions logs metrics analysis & monitoring, Search
Domain: Telecom IT
The Logstash collects logs from multiple applications and indexes to ES in a different Index for each application. For example
Logs from App 1 would be indexed to Index_1
Logs from App 2 would be indexed to Index_2
Logs from App 3 would be indexed to Index_3
These logs can/may not be inserted to the same Index, as these are with different formats.
Each Index has a common filed say subscriber ID.
I want to search for the information of a subscriber joining the data for multiple Indexes. How can I achieve this !! I have gone through few options like parent-child relationship, de normalize at index time.. However those may not be applicable in my use case.
Kindly suggest any approach.