Searching when multiple indices have same field

[misiakj (Jon)]

I have a few different indices, each of which have a different data type that they represent. Each of these data types are related.

For Example

Issue Index,
Tag Index,
Audit Trail Index.

Each with a single data type . (Issue, Tag, Audit Entry)

Each of these data types has a case_id field, and a number of other fields related to that data type.

I would like to have a Dashboard where I can do something like the below.

Filter on Tag by a field that only exists in the Tag index (Tagger for example).
Select All Case_ID by that filter.
Filter Issues by those case ids.

Is this possible? This would be similar to what in SQL would look like
SELECT * FROM issues WHERE case_id in (SELECT case_id FROM tags WHERE tagger = 'jon smith');

[Brandon_Kobel]

Hey @misiakj,

If you were to create documents similar to the following:

POST countries/_doc
{
  "country": "USA"
}

POST countries/_doc
{
  "country": "CN"
}

POST countries/_doc
{
  "country": "BZ"
}


POST municipalities/_doc
{
  "name": "California",
  "country": "USA"
}

POST municipalities/_doc
{
  "name": "Texas",
  "country": "USA"
}

POST municipalities/_doc
{
  "name": "California",
  "country": "USA"
}

POST municipalities/_doc
{
  "name": "São Paulo",
  "country": "BZ"
}

POST municipalities/_doc
{
  "name": " Brasília",
  "country": "BZ"
}

POST municipalities/_doc
{
  "name": "Shanghai",
  "country": "CN"
}

POST municipalities/_doc
{
  "name": " Beijing",
  "country": "CN"
}

Then you could create two index patterns, one for Countries and one for Municipalities.

Then you can create two Visualizations, one which is the "Input Control" defined like so:

And then if you added both to a Dashboard, you could use the Input Controls visualization to filter which Municipalities are shown: