Kibana Query Question

Elastic Stack Kibana
1

Hello guys
Is it possible and how can I to filter documents from one index according to values from another index?
For example I have 2 indexes Logs and Activities

ELK
ELK992×379 9.36 KB

I want to see in visualisation documents from index Logs only for specific ID.
For example ID 1111 have 2 log files(file1.log, file3.log). I want to display documents from index Logs where Logfile==(File from index Activities where ID==1111).
Is it posible to do it?
Thanks in advance!

2

I have query on SQL:

SELECT * FROM [Logs]
JOIN Activities ON Activities.ID= "1111" and Activities.File = Logs.Logfile;

I need something similar on KQL. Somebody can help me?

3

Don't think that is possible using KQL. I'd suggest making a transform that will do that transformation from 2 indexes into 1 and then you query from that 1.

4

Correct, you cannot do that without "joining" both indices into one.

5

Thank you. I don't see option how to transform 2 indexes into 1. I see in documentation that transform don't intended for that.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.