Linking separate log records

[kibanaquery]

Hi,

I was wondering if is possible to perform a basic link function (either in Discover or Visualise)?

All my records have a common identifier, say "LinkID", but only some records have "Type" and only some have "Colour".

What I'd like to do is count how many records have "Type" of "Cheese" and "Colour" of "Yellow".
Which is fine when its all in one record, but how do I count them when they are in different records (albeit tied by the LinkID value)?

[jsanz (Jorge Sanz)]

I could set up a simple data table based in this testing index that follows your example

PUT test_links
{
  "mappings": {
    "properties": {
      "linkid": {
        "type": "integer"
      },
      "colour": {
        "type": "keyword"
      },
      "type": {
        "type": "keyword"
      }
    }
  }
}


POST test_links/_bulk
{ "index" : { "_id" : "1" } }
{ "linkid" : 1 }
{ "index" : { "_id" : "2" } }
{ "linkid" : 1, "colour": "blue" }
{ "index" : { "_id" : "3" } }
{ "linkid" : 1, "type": "cheese" }
{ "index" : { "_id" : "4" } }
{ "linkid" : 2, "colour": "red", "type": "cheese" }
{ "index" : { "_id" : "5" } }
{ "linkid" : 3, "colour": "orange", "type": "bread" }
{ "index" : { "_id" : "6" } }
{ "linkid" : 4, "colour": "orange" }
{ "index" : { "_id" : "7" } }
{ "linkid" : 4, "type": "cheese" }

Then the table needs to use a histogram with a 1 value range step and for the metrics use a Top Hit aggregation for each field

Hope it helps!

[kibanaquery]

Thanks for your help, I'll check this out.