0

I've two different indices on a Elasticsearch server. On index A document have the fields "date" and "fieldX" and on on index B I have the fields "date" and "fieldY".

The date element is a 1:1 relation, meaning for every date there's one document in index A and B. I want to count the documents with the value X of "fieldX" and the value Y of "fieldY" with the matching dates.

I know elasticsearch is not intended for such queries, but I can't change the data structure in this case.

1 Answer 1

1

Since there are no joins in elastic search a single query cannot check records from both index. If you can change mapping you can look for nested type and parent-child mapping.

As mentioned in your question, you cannot change mapping of the indices. Then you need to make either two separate call for each index or use _msearch to send multiple requests at once.

GET _msearch
{"index":"index85"}
{"query":{"term":{"date":"2020-05-26"}},"aggs":{"count":{"value_count":{"field":"date"}}}}
{"index":"index86"}
{"query":{"term":{"date":"2020-05-26"}},"aggs":{"count":{"value_count":{"field":"date"}}}}
Sign up to request clarification or add additional context in comments.

2 Comments

Thanks a lot for the fast response. With _msearch I would have to do this search for every single date 'manually'? I'm planning to create a visualization, so this probably won't be suitable.
@daniel I don't have experience with visualization so don't know if it will support it or not. You can write normal queries in _msearch, use a date histogram aggregation for each date

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.