Query multiple mapping indices in visualization

Elastic Stack Kibana
1

we have a index pattern with few indices with two different mapping, few fields are present in both mapping.
we want bucket the common fields from both mapping indices and want to perform metric aggs on data from both mapping indices to be in same visualization.

How to query different mapping index simultaneously to group fields on bucket level?

Index Pattern = customer_entity*
Indices= customer_entity_sales, customer_entity_visit

Sample:
Index => "customer_entity_sales"
Customer 		Code 				VolumeOfSale	GrossSale
XYZABC			123456789			10,929			70,121.3

Index => "customer_entity_visit"
Customer 		Code 			LastVisitDate			DayOfWeek		
XYZABC			123456789		Aug 3, 2020 @ 00:00		2

table vizualization for index pattern "customer_entity*"

Customer 		Code 				VolumeOfSale	GrossSale	LastVisitDate		DayOfWeek
XYZABC			123456789			10,929			70,121.3    Aug 3, 2020 @ 00:00	2

Kindly let us know how to achieve this?

2

Kindly Help

3

Sounds like you already have an index pattern that covers the indices you need. Visualizations can be created using any index pattern as a source which will use data from both indices.

You can read more about it in our docs: https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-index.html

4

Thanks @myasonik ,

Both of the index have different mapping which we defined in index pattern.

In Viz i have a data table, where bucket terms are present in both different index mapping. In metrics i want to have max date from customer_entity_visit which is not available in customer_entity_sales and vice versa sum of gross sales available only on sales index not on visit.

Problem is either first metric is showing result and another metric is showing null or zero value. If i move the second aggregation to first place then previous one becomes null or zero. I want to show both metrics on table which have common bucket terms among each different indices.

5

I'm not sure I totally follow...

It sounds like you want to create 1 data table, of two indices, with some overlapping data. And then you want to perform some operations on the data based on a field that only exists in one index and not the other... Is that second part correct?

If I understood correctly, I don't think that's something you can accomplish.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.