Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fdataprime%2Fuser-guide%2Fusing-dataprime%2Fjoin_union.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fdataprime%2Fuser-guide%2Fusing-dataprime%2Fjoin_union.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# How to use DataPrime to combine datasets and correlate logs

## Goal[​](#goal "Direct link to Goal")

By the end of this guide you should be able to:

* Use `join` to combine logs and traces by shared fields
* Use `union` to merge datasets with compatible schemas
* Use identifier-based filtering to correlate logs without a formal join

## Why it matters[​](#why-it-matters "Direct link to Why it matters")

Real-world debugging rarely involves a single service. To understand the full picture, you often need to combine data from multiple sources—logs, traces, or metrics—based on shared identifiers like `request_id`, `trace_id`, or `user_id`. This guide helps you unify fragmented data into a cohesive timeline for triage, monitoring, and root cause analysis.

***

## Combining datasets using `join`[​](#combining-datasets-using-join "Direct link to combining-datasets-using-join")

### Description[​](#description "Direct link to Description")

The `join` command combines two datasets by matching a common field (e.g., `trace_id`, `request_id`). It's useful for enriching logs with related events from another source.

Note

Joins can be resource intensive. Try to filter as much as possible before joining.

### Syntax[​](#syntax "Direct link to Syntax")

```
<query1>

| join (

  <query2>

) on <join_condition>
```

***

## Merging datasets using `union`[​](#merging-datasets-using-union "Direct link to merging-datasets-using-union")

### Description[​](#description-1 "Direct link to Description")

The `union` command merges two datasets into a single stream. Both sources should have compatible schemas or be normalized with `choose`.

### Syntax[​](#syntax-1 "Direct link to Syntax")

```
<query1>

| union (

  <query2>

)
```

***

## Common pitfalls[​](#common-pitfalls "Direct link to Common pitfalls")

* **Unfiltered joins**: Always apply `filter` before `join` to avoid performance issues.
* **Mismatched schemas**: Use `choose` to normalize fields before `union`.
* **Missing correlation keys**: Without a shared ID like `request_id`, correlation is not possible.