Join related data from two indices

(Jeremy A ) #1

Let's say I'm using Logstash to pull in data about sales in many franchise locations, and then I have the metadata about these locations (e.g. address, manager name, etc.) in a separate SQL Server database. The sales data (CSV) and metadata are related based on a store ID. Currently I have just pulled all the data from SQL into a separate index (so I now have two indices, "sales" and "meta") but I don't think it will be easy to work with that way. What would be the easiest way to "join" the metadata to the sales data in order to aggregate based on location for example? In other words, how should I approach denormalizing this data? Is this more of a Logstash thing?
Would appreciate any insights. We have access to the full Elastic stack and X-PACK tools and can re-index if necessary.