Saviynt unveils its cutting-edge Intelligence Suite products to revolutionize Identity Security!
Click HERE to see how Saviynt Intelligence is transforming the industry.
Saviynt Copilot Icon

Elastic Search Query - Join Indices

AnkitaBamania
New Contributor
New Contributor

Hello Team,

I am working on Data Query under Analytics. I have created two analytics report which is assigned as indices in elastic query report. There is one field from both the indices based on which I want to perform comparison and based on that the data should display from both the indices. Basically, I want to join two indices based on that field.

Can anyone help me with that?

3 REPLIES 3

rushikeshvartak
All-Star
All-Star

Provide screenshot of configs


Regards,
Rushikesh Vartak
If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'.

Hi @rushikeshvartak ,

Below are the screenshots:

Elastic query configuration- 

AnkitaBamania_0-1719547461145.png

Indices subquery1Test -

AnkitaBamania_1-1719547555984.png

Indices Subquery3Test:

AnkitaBamania_2-1719547710283.png

We need to join Entitlementvaluekey from 1st index with funt_ent from second index.

Thanks,

Ankita Bamania

[This message has been edited by moderator to mask sensitive information]

Sample

{
"source": {
"index": ["index1", "index2"]
},
"pivot": {
"group_by": {
"common_field": { "terms": { "field": "common_field" } }
},
"aggregations": {
"index1_data": { "top_hits": { "_source": ["field1", "field2"] } },
"index2_data": { "top_hits": { "_source": ["field3", "field4"] } }
}
},
"dest": {
"index": "joined_index"
}
}


Regards,
Rushikesh Vartak
If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'.