We have one index prod-logs-sa where we have some data and a field AppId. This field has GUID data. Another index prod-applications in where Appname and AppId are kept. Now I want to view data from that shows AppName alongwith data from index prod-logs-sa. How can this be done.
The best answer is really that you need to denormalize your data by including the data from prod-application you want in prod-logs-sa. Alternatively, you could utilize the
include_in_parent mapping. More details outlined here: https://github.com/elastic/kibana/issues/1084
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.