Join in Kibana to fetch data from two ElasticSearch indexes

Question

I have two indexes "indexname" and "indexnamelookup" in the elasticsearch instance. And I have created index pattern indexname* in kibana and trying to join two fields "IP"(field in indexname) and "location.IP"(field in indexnamelookup).

GET /indexname*/_search?q=*
{
    "query": {
        "multi_match": {
            "query": "",
            "fields": [
                "IP",
                "location.IP"
            ]
        }
        }
}

Above query is working fine in elasticsearch. But it is not working in kibana. Has anyone else faced a similar situation?

xeraa xeraa · Accepted Answer · 2019-07-24T22:45:38

The ?q=* in your query turns it into a match all that ignores the body.
I assume we're talking about Discover in Kibana: The query location.IP : "foo" or IP : "foo" will work.
Alternatively you can use your Elasticsearch query in Kibana as well if you add a filter and then use the Query DSL:

Join in Kibana to fetch data from two ElasticSearch indexes

1 Answers