Hi
I have 2 indexes in elastic search
Index 1/Data Source 1 - ClientIP, ServerIP, RealIP, Transit IP, Metric 1, Metric 2
Index 2/Data Source 2 - ClientIP, ServerIP, Metric 3, Metric 4
Eg:
DataSource 1 : example row
192.168.1.1, 192.268.1.75, 109.10.1.2, 10.10.10.1, Metric 1, Metric 2
DataSource 2 : example row
192.168.1.1, 192.268.1.75, Metric 3, Metric 4
ClientIP and Server IP are correlating fields between DataSource1 and DataSource2
The reason the datasources have been setup this way is because, One row in DataSource 2 can have multiple rows in DataSource 1
I have setup a template variable for RealIP with query going to DataSource1
in the dashboard. Dashboard user can only choose a RealIP as filter, he does not know ClientIP/ServerIP
Now i need to add a table panel with mixed queries each going to each datasource, join the queries with ClientIP and ServerIP as common correlation factor and show single row with all metrics. Output should look like
ClientIP, ServerIP, Real IP, Transit IP, Metric 1, Metric 2, Metric 3, Metric 4
I have 2 queries, 1st query going to Index 1/Datasource1 and 2nd query going to Index 2/DataSource2
I am passing RealIP template variable value chosen by dashboard user to query 1 for RealIP, however i need to pass the ClientIP & ServerIP associated with this RealIP picked up from Query 1/DataSource1 to ClientIP and ServerIP field in Query 2 to filter the right matching row in Query 2
Is there a way to do this ?
I know i can setup 2 separate dashboards and send Data link context using template variables however that will result in broken visualization across 2 dashboards which is not desired. The requirement is to query, correlate, match and show all data in one table panel,
any ideas is appreciated
Thanks
Venkat