# Visualizing across Distinct Indices

**URL:** <https://discuss.elastic.co/t/visualizing-across-distinct-indices/286394>\
**Category:** Kibana\
**Created:** [October 11, 2021, 4:56pm UTC](https://discuss.elastic.co/t/visualizing-across-distinct-indices/286394 "2021-10-11T16:56:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gaganb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaganb/32/95707_2.png) [@gaganb](https://discuss.elastic.co/u/gaganb)\
**Post date:** [October 11, 2021, 4:56pm UTC](https://discuss.elastic.co/t/visualizing-across-distinct-indices/286394/1 "2021-10-11T16:56:55Z")

</div>

Hi all,

I wanted to visualize data from two distinct indexes that do not share a common substring.

Let's say I have Index A and Index B, both distinct names with no same substring.

Both indexes have one common element "uniqueID".

However, Index B has some extra data I want to pull for visualizations alongside some data from Index A. I want them to be matched on basis of uniqueID.

Since these two have distinct names, I cannot just use an index pattern.

I planned on creating the same alias for both indexes, and then create an index pattern out of that alias.

Finally, use that merged index pattern to create my visualizations with data pulled from both indexes.

Would this work? Is there a better way to do this?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 12, 2021, 12:21am UTC](https://discuss.elastic.co/t/visualizing-across-distinct-indices/286394/2 "2021-10-12T00:21:16Z")

</div>

Welcome to our community! 😃

You're after a join, which is't possible to do in Elasticsearch or Kibana. Your best approach would be to reindex the data and merge both indices together so they are in a single index with all attributes in each document.

---

<div class="post-metadata">

**Author:** ![gaganb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaganb/32/95707_2.png) [@gaganb](https://discuss.elastic.co/u/gaganb)\
**Post date:** [October 12, 2021, 1:46am UTC](https://discuss.elastic.co/t/visualizing-across-distinct-indices/286394/3 "2021-10-12T01:46:41Z")

</div>

Thanks for the info!

If I were to reindex, would all future logs that come into these two indexes be merged as well?

Or would I have to manually set a pipeline that does it for me?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 12, 2021, 2:09am UTC](https://discuss.elastic.co/t/visualizing-across-distinct-indices/286394/4 "2021-10-12T02:09:51Z")

</div>

Definitely the latter.

---

<div class="post-metadata">

**Author:** ![Marco\_Liberati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marco_liberati/32/82953_2.png) [@Marco\_Liberati](https://discuss.elastic.co/u/Marco_Liberati)\
**Post date:** [October 12, 2021, 10:25am UTC](https://discuss.elastic.co/t/visualizing-across-distinct-indices/286394/5 "2021-10-12T10:25:06Z")

</div>

Depending on how you want to merge the data from the two index, you can combine multiple layers using a different index pattern for each layer:

 ![Screenshot 2021-10-12 at 12.24.14](https://us1.discourse-cdn.com/elastic/original/3X/6/2/6224fff213db3977e603713d66ee94440e51e6bf.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2021, 10:25am UTC](https://discuss.elastic.co/t/visualizing-across-distinct-indices/286394/6 "2021-11-09T10:25:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
