Visualizing across Distinct Indices

[gaganb (Gagan Bhat)]

Hi all,

I wanted to visualize data from two distinct indexes that do not share a common substring.

Let's say I have Index A and Index B, both distinct names with no same substring.

Both indexes have one common element "uniqueID".

However, Index B has some extra data I want to pull for visualizations alongside some data from Index A. I want them to be matched on basis of uniqueID.

Since these two have distinct names, I cannot just use an index pattern.

I planned on creating the same alias for both indexes, and then create an index pattern out of that alias.

Finally, use that merged index pattern to create my visualizations with data pulled from both indexes.

Would this work? Is there a better way to do this?

[warkolm (Mark Walkom)]

Welcome to our community!

You're after a join, which is't possible to do in Elasticsearch or Kibana. Your best approach would be to reindex the data and merge both indices together so they are in a single index with all attributes in each document.

[gaganb (Gagan Bhat)]

Thanks for the info!

If I were to reindex, would all future logs that come into these two indexes be merged as well?

Or would I have to manually set a pipeline that does it for me?

[warkolm (Mark Walkom)]

Definitely the latter.

[Marco_Liberati]

Depending on how you want to merge the data from the two index, you can combine multiple layers using a different index pattern for each layer: