It depends what you intend when you say JOIN. Elasticsearch is not like regular database that supports JOIN between tables. It is a text search engine that manages documents within indexes. On the other hand you can search within the same index over multiple types using a fields that are common to every type. For … Read more
You can achieve this with the Logstash aggregate filter only, however, you’d have to substantially re-implement what the elapsed filter already does, so that’d be a shame, right? Let’s then use a mix of the Logstash aggregate filter and the elapsed filter. The latter is used to measure the time of each stage and the … Read more
That’s a great start! I would definitely flatten it all out (i.e. denormalize) and come up with product documents that look like the one below. That way you get rid of the N:M relationship between products and flags by simply creating a flags array for each product. It will thus be easier to query those … Read more
By default logstash writes the position is last was on to a logfile which usually resides in $HOME/.sincedb. Logstash can be fooled into believing it never parsed the logfile by specifying /dev/null as sincedb_path. Here the part of the documentation Input File. Where to write the since database (keeps track of the current position of … Read more