Transforming multiple documents to a single document for a Kibana visualization

Elastic Stack Elasticsearch
1

Hi,

I have the following documents in the same Index

timestamp | sessionID=123 | IPAddress="1.1.1.1"
timestamp | sessionID=123 | username=harry
timestamp | sessionID=123 | error=1002
timestamp | sessionID=123 | reconnect=true
timestamp | sessionID=123 | error=1004

I would like to be able to turn this into a DataTable visualization that looks like this:

Session ID | Username | Count(error) | Count(reconnect)

Is it possible to transform the documents into a new Index?

Ideally I would like this to be a realtime/continuous transformation.

Thanks

2

I am not sure I exactly understand the data or how you expect it to end up, but suspect you might want to look at the new transforms feature.