Hi all
INDEX 1 = sid_agent_276043_tsfm_idx (docs = 18842)
{
"sid_agent_276043_tsfm_idx": {
"mappings": {
"_meta": {
"created_by": "transform",
"_transform": {
"transform": "sid_agent_276043",
"version": {
"created": "7.7.0"
},
"creation_date_in_millis": 1594324251360
}
},
"properties": {
"data": {
"properties": {
"sessionid": {
"properties": {
"keyword": {
"type": "keyword"
}
}
},
"ts": {
"properties": {
"avg": {
"properties": {
"agent": {
"type": "double"
}
}
},
"max": {
"properties": {
"agent": {
"type": "date"
}
}
},
"min": {
"properties": {
"agent": {
"type": "date"
}
}
}
}
}
}
}
}
}
}
}
INDEX 2 = sid_all_276043_tsfm_idx (docs = 110201)
{
"sid_all_276043_tsfm_idx": {
"mappings": {
"_meta": {
"created_by": "transform",
"_transform": {
"transform": "sid_all_276043",
"version": {
"created": "7.7.0"
},
"creation_date_in_millis": 1594324096704
}
},
"properties": {
"data": {
"properties": {
"sessionid": {
"properties": {
"keyword": {
"type": "keyword"
}
}
},
"ts": {
"properties": {
"avg": {
"properties": {
"all": {
"type": "double"
}
}
},
"max": {
"properties": {
"all": {
"type": "date"
}
}
},
"min": {
"properties": {
"all": {
"type": "date"
}
}
}
}
}
}
}
}
}
}
}
INDEX-PATTERN USECASE 1
Index-Pattern Name = sid*
This index pattern matches 2 indices.
- sid_agent_276043_tsfm_idx
- sid_all_276043_tsfm_idx
TimeFilter field name = data.ts.min.all
Resultant records = 110201
INDEX-PATTERN USECASE 2
Index-Pattern Name = sid*
This index pattern matches 2 indices.
- sid_agent_276043_tsfm_idx
- sid_all_276043_tsfm_idx
TimeFilter field name = data.ts.min.agent
Resultant records = 18842
INDEX-PATTERN USECASE 3
Index-Pattern Name = sid*
This index pattern matches 2 indices.
- sid_agent_276043_tsfm_idx
- sid_all_276043_tsfm_idx
TimeFilter field name = "I dont want to use the Time Filter"
Resultant records = 18842 + 110201 = 129043
I need a way to create an index-pattern with these two indices and be able to use a timestamp filter and get a total of 129043 records
How do I do this ?
Thanks
sanjay