elasticsearch - Kibana: joining two documents in table visualization -
i have data table visualization displaying fields documents have email address , id:
timestamp | email | field_id feb 5th jdoe@gmail.com xyz123
these fields belong same elastic document. however, have other documents information pertaining unique id, , can display these own table:
timestamp | field_id | key1 | key2 | key3 feb 6th xyz123 val1 val2 val3
you can see row in first table , 1 on second table have field_id in common. i'd know whether possible display merged row kibana and/or elastic query:
field_id | email | key1 | key2 | key3 xyz123 jdoe@gmail.com val1 val2 val3
this equivalent join relation database in sql. if not possible in kibana, maybe there way achieve indirectly query using json input elastic , perform kind of application-side join?
it looks try using knowledge of relational databases no-sql databases such elasticsearch (es). there several options have.
option #1. save information have same document. if more data after initial document indexed, update keys. if different documents have different schemas (aka set of keys), it's not problem es. also, when querying es, can specify fields want retrieve if concerned size of requests/responses es.
option #2. can use different types
different id/email documents, , id/keys documents, keep storing them in same index
. then, can create dashboard , put several visualizations: a) data table ability choose id
; b) email visualization shows email
s (as select id
in visualization a) clicking on it, kibana show email of document given id
c) keys visualization shows keys
(again, select id
or email
, visualization update show keys related selection)
option #3. save above, can have different indices
instead of different types
. long indices have common prefix (e.g. docs-email
, docs-keys
), can use prefix in kibana retrieve data different indices
option #4. application-level join described in question. es provides rest api on data stores. can retrieve whatever need , build client-side join (it makes 1 wonder why did choose es backend storing data instead of relational db)
Comments
Post a Comment