# Query with multiple indices vs a unique index?

**URL:** <https://discuss.elastic.co/t/query-with-multiple-indices-vs-a-unique-index/109430>\
**Category:** Elasticsearch\
**Created:** [November 28, 2017, 4:04pm UTC](https://discuss.elastic.co/t/query-with-multiple-indices-vs-a-unique-index/109430 "2017-11-28T16:04:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![samia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samia/32/29046_2.png) [@samia](https://discuss.elastic.co/u/samia)\
**Post date:** [November 28, 2017, 4:04pm UTC](https://discuss.elastic.co/t/query-with-multiple-indices-vs-a-unique-index/109430/1 "2017-11-28T16:04:18Z")

</div>

Hello,

I have a _daily_ index of log where I have something like :

[date and time] [Client ID] [Other fields]

My daily indices are created on a daily basis via Logstash.

I'd like to create a vizualisation in Kibana, more exactly a table like this :

[Client] [number of occurences in logs]

In addition to the daily logs, I have a simple index where the "client ID" is associated to the actual "client name".

In my Kibana table, I'd like to make the "Client name" appear instead of the "client ID".

Is there a way to query ElasticSearch for these 2 indices (kind of SQL join) or Should I add a field with the actual client names in the log indices ?

Thank you for your help.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 28, 2017, 4:17pm UTC](https://discuss.elastic.co/t/query-with-multiple-indices-vs-a-unique-index/109430/2 "2017-11-28T16:17:51Z")

</div>

You can’t do joins in elasticsearch.  
Always better to solve that at index time IMO.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 26, 2017, 4:18pm UTC](https://discuss.elastic.co/t/query-with-multiple-indices-vs-a-unique-index/109430/3 "2017-12-26T16:18:01Z")

</div>

Closed on December 26, 2017, 4:18pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.