Join query in elasticsearch

hi team

can anyone convert this sql query to elasticsearch dsl query or lucene query or painless script?

select (t2.log_timestamp - t1.log_timestamp) as elapsed_time
from tbl_logs t1 inner join tbl_logs t2
on t1.order_id = t2.order_id

plz guide

You cannot do joins in Elasticsearch.

any option to emulate joining?

You can create an entity-centric index with one document per order. As new time stamps and other information arrives you then update the appropriate document instead of storing it separately. This will make it a lot easier to run the type of queries you described.o


you mean to become one doc., right?
but actually my app logs are continuous. how do i create entity-centric index one document per order? :disappointed_relieved:
plz guide me.

Have a look at this Elastic{ON} talk. This video may also be useful.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.