Summary index transform reference

Elastic Stack Elasticsearch
1

I have a bunch of indices I’d like merge into a single summary index. From what I read, "Transforming data | Elastic Docs" is the way to go but I’m not find the way to do this. Here it goes.

The indices I have are something like this…
Index: accounts
Sample documents:

{
   "id": "1",
   "name": "account 1",
   "some_prop": "account 1 some_prop"
},
{
   "id": "2",
   "name": "account 2",
   "some_prop": "account 2 some_prop"
}

Index: account_survey_answer
Sample documents:

{
   "account_id": "1",
   "question_id": "a",
   "answer": "account 1 answer a"
},
{
   "account_id": "1",
   "question_id": "b",
   "answer": "account 1 answer b"
},
{
   "account_id": "2",
   "question_id": "a",
   "answer": "account 2 answer a"
},
{
   "account_id": "2",
   "question_id": "b",
   "answer": "account 2 answer b"
}

The wish is that the destination index of the transform looks something like this:

{
   "account_id": "1",
   "name": "account 1",
   "some_prop": "account 1 some_prop",
   "answer_a": "account 1 answer a",
   "answer_b": "account 1 answer b"
},
{
   "account_id": "2",
   "name": "account 2",
   "some_prop": "account 2 some_prop",
   "answer_a": "account 2 answer a",
   "answer_b": "account 2 answer b"
}

Is this possible and, if so, I may I achieve it?
Thank you, in advance for any help.

2

Welcome @bigsby!

To confirm you want to merge the documents based on the account_id attribute? You should be able to use an enrich processor in an ingest pipeline. The below example should help you get started.

Alternatively if you want to join the results without creating a new index, and are on a later version you could try using a LOOKUP JOIN or ENRICH operation.

Hope that helps!