Joining two indexes

Elastic Stack Kibana
1

Hi,
I have two indices A and B. I wanted to perform inner join on the two indices using a common field such that I can collect the fields(spread across both indices) into another index using transforms.

What aggregations would need to be performed to achieve an inner join?

Regards
Eby

2

Hi @etp,
Elasticsearch does provide a native lightweight structured query language. Having said that when trying to run a sql statement with a join you will get the response: "Queries with multiple indices are not supported'.

Other solutions include nested queries and child/parent queries.

All of these options though just work on data in the same index. So reindexing both indices into a common index might be needed to achieve what you are looking to do.

Hopefully that gives you a good place to start. Transitioning from a sql mindset to a "no sql" one can be rough, but will a little work you'll find it pays off. :grinning: Good luck!

3

One possibility is to use something like the lookup runtime field for this. I created a somewhat pseudo code example here.

2 Likes
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.