Kibana Query Question

Hello guys
Is it possible and how can I to filter documents from one index according to values from another index?
For example I have 2 indexes Logs and Activities


I want to see in visualisation documents from index Logs only for specific ID.
For example ID 1111 have 2 log files(file1.log, file3.log). I want to display documents from index Logs where Logfile==(File from index Activities where ID==1111).
Is it posible to do it?
Thanks in advance!

I have query on SQL:

SELECT * FROM [Logs]
JOIN Activities ON Activities.ID= "1111" and Activities.File = Logs.Logfile;

I need something similar on KQL. Somebody can help me?

Don't think that is possible using KQL. I'd suggest making a transform that will do that transformation from 2 indexes into 1 and then you query from that 1.

Correct, you cannot do that without "joining" both indices into one.

Thank you. I don't see option how to transform 2 indexes into 1. I see in documentation that transform don't intended for that.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.