Query Two Subtypes in the same index

Elastic Stack Kibana
1

Hello : Had a question around how to search against TWO subtypes in the same index?
This is my index setup:
myindex/calldata
myindex/customerdata

a call data has a field called message which looks like this : { callerid : abcd, file=123}
customerdata looks like thjis : {customerid : aabbcc, file=123}

There is a common field file as shown above to both types calldata and customerdata
I would like to do a search like this:
"Get me all calldata and customerdata where calldata has some callerid ABCD1234"

How would I do this?

2

@titan1978 are you attempting to search using Discover, or create a Visualization against that field? Also which version of Kibana are you using?

3

using discover and 5.5

4

@Brandon_Kobel Using Discovery and 5.5 . Any suggestions would help even how would I do this using Visualizations?

5

@titan1978 in 5.5 you should be able to use Visualize and Discover seamlessly across types that share a common field. If you go to Management -> Index Patterns and select your Index Pattern, do you see the file field listed? What happens when you try to Search/Visualize against this common field?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.