# Visualize in a graph the match value from multiple indexes

**URL:** <https://discuss.elastic.co/t/visualize-in-a-graph-the-match-value-from-multiple-indexes/310402>\
**Category:** Kibana\
**Created:** [July 22, 2022, 12:46pm UTC](https://discuss.elastic.co/t/visualize-in-a-graph-the-match-value-from-multiple-indexes/310402 "2022-07-22T12:46:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mrestrepo](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@mrestrepo](https://discuss.elastic.co/u/mrestrepo)\
**Post date:** [July 22, 2022, 12:46pm UTC](https://discuss.elastic.co/t/visualize-in-a-graph-the-match-value-from-multiple-indexes/310402/1 "2022-07-22T12:46:46Z")

</div>

Hi all.  
I have 2 different indexes in kibana, first one is an early alert from something and the other one is when the user report the event, so i need to visualize when the alert and the user report match.  
So i can hace a linear graph or a dispersion dots graph that allow me to compare and fin when both index data match  
How can i do it?

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [July 22, 2022, 12:54pm UTC](https://discuss.elastic.co/t/visualize-in-a-graph-the-match-value-from-multiple-indexes/310402/2 "2022-07-22T12:54:25Z")

</div>

As this would imply joining data from two indices, it's not possible directly in Elasticsearch today (we are working on it, though!).

You might be able to leverage transforms for this though: [Transforming data | Elasticsearch Guide [8.3] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html)

Create a transform on both the early alert and the user report index, pivot on the event id field (the join key basically) and record the number of documents as the metric - if there are two documents, then the event was recognized by alerting and subsequently reported.

---

<div class="post-metadata">

**Author:** ![mrestrepo](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@mrestrepo](https://discuss.elastic.co/u/mrestrepo)\
**Post date:** [July 22, 2022, 1:01pm UTC](https://discuss.elastic.co/t/visualize-in-a-graph-the-match-value-from-multiple-indexes/310402/3 "2022-07-22T13:01:16Z")

</div>

Hi Joe.  
Thank you for your soon reply, let me check how it works for me as soon as possible and then i come back and tell you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 19, 2022, 1:02pm UTC](https://discuss.elastic.co/t/visualize-in-a-graph-the-match-value-from-multiple-indexes/310402/4 "2022-08-19T13:02:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.