I've indexed some sample data in my elastic node. I can search and retrieve the documents. Now I am trying to see the relationships between these documents using Graph plugin. I've attached a sample document from my index. I want to build the relationship if the entities "_id" field is in another documents "source-entity-ids" field. i.e. show entity 1 is derived from entity 2 and 3.
In kibana I can see my index name and the fields in it, along with a query field. But I am not sure how I can create this relationship. I've tried few things but am not getting any results back.
{
_index: "sample",
_type: "entity",
_id: "1",
_version: 5,
found: true,
_source: {
entity_name: "Some war file",
category: "AWS_S3_object",
source_entity_ids: [ 2, 3]
}
}
Currently, and for reasons of simplicity, we don't provide a way for you to declare that values found in field X can be looked for in field Y. We could conceivably go further and say that field Y is in a different index. Such a mapping will require detailed configuration and so is not in the current release.
For now, you'll need to create a single "ids" field with an array containing both parent and child IDs.
Because all of these IDs are in the same document in your example you'd end up with a triangle with links 1->2, 1->3 and 2->3. If you want to avoid the 2->3 association you would have to create individual docs to express just the 1->2 and 1->3 pairings - these docs would be more reminiscent of the "edge" objects in a classic graph DB.
The troubleshooting guide has a section on adjusting the link relevance settings in the API. In the GUI, these are controlled by turning "significant_links" off and setting the certainty threshold to 1.
[1] _id field | Elasticsearch Guide [8.11] | Elastic
[2] Troubleshooting | Elasticsearch Graph [2.4] | Elastic