As you may know, Elasticsearch is not meant to run JOIN queries at runtime.
I think I would approach this as:
Process your incoming data to extract the identifiers using an ingest pipeline, maybe even using the reroute processor to split your logs in different indices.
Create a pivot transform that pivots (merges) the entries with a common UID. You can probably even set up another ingest pipeline in the new output index to generate that format message but you probably want to do that later.
I'm unsure how this plays with your Kibana Watcher use case, but it seems worth exploring.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.