I have 2 elastic indexes called index1 and index2. index2 contains entries where some of the rows from index1 has been replicated with a single field change.
I want to execute one single query in Elastic from both the index and get all the values out of there in a single result (I can run multiple queries and achieve the desired. But as the Data volume is very high, want to optimize the time if possible).
a) index2 values that match (by ID, a field) with index1 will be updated only on the results.
b) Rest of the index1 data will come as usual on the results.
c) Both the data will come as combined in the results.
In short, index2 will have priority for the results. I have tried many code variations (script, source, nested, ordering) of Elastic but failed to achieve the desired output.
Can anyone kindly help with it, please? Thanks a lot.
It should be possible to achieve what you need using field collapsing, i.e. by collapsing on the ID field and leveraging inner_hits with sort by _index
GET index1,index2/_search
{
"query": {
"terms": {
"ID": ["12345", "23456", "34567"]
}
},
"collapse": {
"field": "ID",
"inner_hits": {
"name": "most_recent",
"size": 5,
"sort": [ { "_index": "desc" } ]
}
}
}