I'm building Analytics Dashboards in Kibana for understanding user behavior, creating funnels and that type of thing.
I'm recording events associated with each user coming from different applications.
I'm not sure how to model my data so it's the most useful it can be in Kibana, which we'll be using for analyzing the data.
I have one index for events and one index for users.
Each user has more or less this information:
- Multiple licenses with type, starting date and expiration.
- Business information like tier, revenue, type of deal, etc.
- Information about the organization they belong too.
When analyzing the data in Kibana I would like to be able to filter events by any of the user's values.
E.g. Count events of type x for users with y revenue with a license that will expire next month.
I know one approach could be denormalizing the user data into each event. I'm trying to get my head around that because it sounds not optimal at all. There would be more data from the user in each event than from the event itself.
Parent/child relationship should be on the same index, so it doesn't seem like a good approach.
Is it possible to use some kind of cross-filter in Kibana where the result of a given filter could be used as a filter in another index? For example, filtering users by license expiration and then filtering events matching those user's ids?
How do you think I should go about this?