# Need recommendations for related data querying

**URL:** <https://discuss.elastic.co/t/need-recommendations-for-related-data-querying/143110>\
**Category:** Elasticsearch\
**Created:** [August 6, 2018, 7:40am UTC](https://discuss.elastic.co/t/need-recommendations-for-related-data-querying/143110 "2018-08-06T07:40:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![gliu](https://avatars.discourse-cdn.com/v4/letter/g/e99b99/32.png) [@gliu](https://discuss.elastic.co/u/gliu)\
**Post date:** [August 6, 2018, 7:40am UTC](https://discuss.elastic.co/t/need-recommendations-for-related-data-querying/143110/1 "2018-08-06T07:40:25Z")

</div>

I'm new to elastic search and are now struggling with modeling the data structure.  
I have many devices like  
device: {  
identifier,  
IP,  
MAC,  
name,  
provider,  
last\_active\_time,  
etc..  
}

and devices keep reporting their status(or property) continuously,  
property is like:  
property {  
device\_identifier,  
property\_name,  
property\_value,  
modified\_time,  
etc...  
}  
device\_identifier + property\_name is unique and property is updated(or upserted) each time it got reported.  
Since there are many devices and each device have one or multiple property. And I need to filter out  
devices which match query condition based on both device and property document.  
should I use nested document or children document ?  
I tried application-side join, but there are too many devices and properties(millions), and is slow.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [August 6, 2018, 8:09am UTC](https://discuss.elastic.co/t/need-recommendations-for-related-data-querying/143110/2 "2018-08-06T08:09:29Z")

</div>

I'd start with something like:

```auto
PUT property/_doc/1
{
  device: {
    identifier: "",
    IP: "",
    MAC: "",
    name: "",
    provider: "",
    last_active_time: "",
  },
  property_name: "",
  property_value: "",
  modified_time: ""
}

```

And see where this goes.

---

<div class="post-metadata">

**Author:** ![gliu](https://avatars.discourse-cdn.com/v4/letter/g/e99b99/32.png) [@gliu](https://discuss.elastic.co/u/gliu)\
**Post date:** [August 6, 2018, 8:36am UTC](https://discuss.elastic.co/t/need-recommendations-for-related-data-querying/143110/3 "2018-08-06T08:36:05Z")

</div>

Thanks for reply.  
Are you suggesting that we should use one document ?  
Each device may have multiple different properties and I need to put it in a list in this case.  
I'm not sure if I can do queries as I expected because the [document](https://www.elastic.co/guide/en/elasticsearch/reference/current/array.html) says:

> Arrays of objects  
> Arrays of objects do not work as you would expect: you cannot query each object independently of the other objects in the array. If you need to be able to do this then you should use the nested datatype instead of the object datatype.
> 
> This is explained in more detail in Nested datatype.

or should I use nested document ?  
document says that any updates to nested types would reindex the source document, I don't want to  
do so because other queries for device, like query devices by their names, may be blocked or slowed down.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [August 6, 2018, 9:01am UTC](https://discuss.elastic.co/t/need-recommendations-for-related-data-querying/143110/4 "2018-08-06T09:01:39Z")

</div>

> [@gliu](#):
>
> Are you suggesting that we should use one document ?

Yes.

And may be both:

- properties
- devices

The later to be able to search for devices only whatever the properties.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 3, 2018, 9:01am UTC](https://discuss.elastic.co/t/need-recommendations-for-related-data-querying/143110/5 "2018-09-03T09:01:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.