Searching Across Multiple Indices


(Christina Galligan) #1

I have two indices.

  1. contains device data including IP, date last seen, vendor, model
  2. contains netflow data IPs, bytes

Is it possible to create a consolidated index that appends the device data to the netflow data? If so, how would I do that?


(Mark Walkom) #2

If they share a similar index pattern naming convention, then yes.

Otherwise you can try setting up a pattern of *.


(Christina Galligan) #3

Thanks Mark, if I wanted to add the field data to the netflow data; what's the best way to set that up?

For example:

  1. device data - 10.10.1.1, dell, poweredge
  2. netflow data - 10.10.1.1, 350

So since the IP addresses match it's the same device and I want to create one record.


(Mark Walkom) #4

Where is the device data kept?


(Christina Galligan) #5

The device data is a different _type in the same index


(Mark Walkom) #6

You probably want to change that, _type will no longer exist in 7.0.

With this though, you really want to add that data to the event during ingestion.


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.