Visualisations with fields from different indexes?

Elastic Stack Kibana
1

Hi everyone!
I have a little question for the wizards of Elastic, here... I hope that someone can help me in clarifying if this is an issue that is affecting my logic, or if I've encountered a limitation of the technology.

Here we go:
I have two indexes, named index1 and index2.
In index1 there are 10 fields.
In index2 there are other 10 fields.
of those 10 fields, two of them are shared between the two indexes. So, the data in those two fields are the same across the indexes.
In total I have 20 fields, 4 of them are overlapping.

I have set up an index pattern like "index*", so in Discover I can browse all the data form the two indexes, but if I want to create a visualisation, even a simple table, I'm having this problem:

As long as I choose the overlapping fields in the index, I can "correlate" the info using the overlapping fields as a correlation element, but if I want to put, to say, Field1 from index1 on the X Axis of a chart, and Field2 from index2 on the Y Axis of a chart, if those fields are not the ones overlapping, nothing is visualised.

There is a way to solve this?

Thank you!!

2

Hi, welcome to the Elastic community! I'm confused by the question because of the example you gave. If field1 and field2 are on different indices, then there will never be any documents that match your aggregations and you will always get an empty visualization. Is there some other way you're trying to match the documents?

3

Thank you for your response!
I'm starting to get the problem: Actually, I need something that is similar to the hated JOIN in SQL language, I suppose:
If I have index1 that contains water precipitation for my country, categorised by city, and index2 that contains higher temperatures for my country, categorised by city, I'll have town and country fields overlapping, but the other data will be impossible to aggregate, because they are in different documents. The best that I can do is have two different visualisations in a dashboard that will react when the overlapping fields are filtered, right?
If I don't get wrong, the only way to "join" those two series of data is before ingestion, is that right? there is no way to obtain some kind of "joined" document at runtime, right?

4

I would definitely start with two different visualizations, like you said. But there are some exceptions. For example:

  1. In the Lens app, your XY charts can contain data from separate indices as long as the values on the X axis share the same name
  2. In the Maps app, you can plot multiple layers and compare against the location- not sure if you actually have geodata, but wanted to mention
  3. You can create a scripted field on your combined index pattern, and the script can do the logic differently depending on the index (not fast, but technically possible)
5

Thank you Wylie, again.
I'll explore the Lens app better!
...and I completely forgot about the scripted fields. Not my very cup of tea, but those are good ideas. Thank you again!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.