Visualisation with * index

[kumpelblase]

I have 2 indices, one with customer numbers and the other with errortypes. I made an index with * to get exerithing into one index, now is it possible to compare these two values, for example in a Vertical Bar chart or a Heatmap? I tried both, but it only said 'No results found'.

[Stacey_Gammon]

You can compare fields from two different indexes like this, but you need some way to connect the two values. What is your desired x-axis and y-axis fields? time and count?

[kumpelblase]

Here are the mappings for the two indices I'd like to compare.

{
"mappings" : {
"ticket" : {
"properties" : {
"TTS_Nummer" : {
"type" : "integer"
},
"TTS_Art" : {
"type" : "short"
},
"TTS_Schweregrad" : {
"type" : "short"
},
"TTS_Prioritaet" : {
"type" : "short"
},
"TTS_Status" : {
"type" : "short"
},
.
.
.
}
}
}
}

Note: The mapping for the type "ticket" is much longer, in total it has 27 fields. One of them is also a timestamp.

{
"mappings" : {
"ticket_customer" : {
"properties" : {
"TKK_KundenNr" : {
"type" : "integer"
},
"TKK_TicketNr" : {
"type" : "integer"
},
"TKK_Custom" : {
"type" : "text"
}
}
}
}
}

They are linked via the fields TTS_Nummer and TKK_TicketNr, it's like private and foreign key from a database. (That's where they're originaly from).

I created a bar chart which counts the ammount of tickets for a customer:

Now I want to separate the bars with the field TTS_Art, so I can see which customer has how many Tickets of which kind.

[Stacey_Gammon]

Actually, I apologize but I don't believe this is possible due to the lack of support of joins in kibana and elasticsearch. I thought it was possible originally, but further investigation and I can't get it to work.

Can you combine the two indexes so a single document contains both customer number and error type?

[kumpelblase]

No problem, I also thought that it isn't possible.

Can you combine the two indexes so a single document contains both customer number and error type?

Do I need to fully reindex the data if I want to combine the indices or can I just combine them in the Kibana console?

[Stacey_Gammon]

I think you'll need to reindex, but you should be able to initiate the command from the Kibana console. https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html . Some of those examples have View in console links.