title: Elasticsearch entity centric indexing
body: <p>does anyone have any experience with entity centric indexing with elasticsearch by using python and groovy scripts for reindex the event centric index into entity centric indexes where every log message has own index or so?</p>
  <p>I've got a lot of following messages:</p>
  <pre><code>Jul 23 09:24:16 msda msda-core[5147]:  1563866656876839.mt
  Jul 23 09:24:18 msda msda-core[5210]:  1563866656876839.0.dn
  </code></pre>
  <p>where I have a lot of the same id numbers with .mt suffix and .dn suffix.</p>
  <p>I always need to find the message with the same id number and appropriate dn suffix if a message with .dn suffix appears within one hour.</p>
  <p>Any idea would be appreciated!</p>