That's the best option though. If this theorical update happens once per year or has less than let say 10m events, I'd probably go that way.
Otherwise, have a look at Join field type | Elasticsearch Guide [7.16] | Elastic
That's the best option though. If this theorical update happens once per year or has less than let say 10m events, I'd probably go that way.
Otherwise, have a look at Join field type | Elasticsearch Guide [7.16] | Elastic
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.