Query with multiple indices vs a unique index?

Elastic Stack Elasticsearch
1

Hello,

I have a daily index of log where I have something like :

[date and time] [ Client ID ] [Other fields]

My daily indices are created on a daily basis via Logstash.

I'd like to create a vizualisation in Kibana, more exactly a table like this :

[Client] [number of occurences in logs]

In addition to the daily logs, I have a simple index where the "client ID" is associated to the actual "client name".

In my Kibana table, I'd like to make the "Client name" appear instead of the "client ID".

Is there a way to query ElasticSearch for these 2 indices (kind of SQL join) or Should I add a field with the actual client names in the log indices ?

Thank you for your help.

2

You can’t do joins in elasticsearch.
Always better to solve that at index time IMO.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.