# Ability to filter the results with a configurable amount of lines around an event

**URL:** <https://discuss.elastic.co/t/ability-to-filter-the-results-with-a-configurable-amount-of-lines-around-an-event/19206>\
**Category:** Elasticsearch\
**Created:** [August 11, 2014, 7:56pm UTC](https://discuss.elastic.co/t/ability-to-filter-the-results-with-a-configurable-amount-of-lines-around-an-event/19206 "2014-08-11T19:56:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ran\_Davidovitz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ran_davidovitz/32/1344_2.png) [@Ran\_Davidovitz](https://discuss.elastic.co/u/Ran_Davidovitz)\
**Post date:** [August 11, 2014, 7:56pm UTC](https://discuss.elastic.co/t/ability-to-filter-the-results-with-a-configurable-amount-of-lines-around-an-event/19206/1 "2014-08-11T19:56:26Z")

</div>

one big aspect of log analysis is to pinpoint a problematic event and than  
see the surrounding events.  
Is there a way to query for X number of event before and after the event ?

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/aa97c0bb-9c7c-444b-8e70-c70e26e61552%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/aa97c0bb-9c7c-444b-8e70-c70e26e61552%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![Itamar\_Syn\_Hershko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/itamar_syn_hershko/32/725_2.png) [@Itamar\_Syn\_Hershko](https://discuss.elastic.co/u/Itamar_Syn_Hershko)\
**Post date:** [August 11, 2014, 8:13pm UTC](https://discuss.elastic.co/t/ability-to-filter-the-results-with-a-configurable-amount-of-lines-around-an-event/19206/2 "2014-08-11T20:13:16Z")

</div>

You can do this using the timestamp (with a range, and grow it if  
necessary) or if you have a serial ID of some sort on the log message you  
can do a range query on that

--

Itamar Syn-Hershko  
[http://code972.com](http://code972.com) | @synhershko [https://twitter.com/synhershko](https://twitter.com/synhershko)  
Freelance Developer & Consultant  
Author of RavenDB in Action [http://manning.com/synhershko/](http://manning.com/synhershko/)

On Mon, Aug 11, 2014 at 10:56 PM, Ran Davidovitz [ran.davidovitz@gmail.com](mailto:ran.davidovitz@gmail.com)  
wrote:

> one big aspect of log analysis is to pinpoint a problematic event and than  
> see the surrounding events.  
> Is there a way to query for X number of event before and after the event ?
> 
> --  
> You received this message because you are subscribed to the Google Groups  
> "elasticsearch" group.  
> To unsubscribe from this group and stop receiving emails from it, send an  
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
> To view this discussion on the web visit  
> [https://groups.google.com/d/msgid/elasticsearch/aa97c0bb-9c7c-444b-8e70-c70e26e61552%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/aa97c0bb-9c7c-444b-8e70-c70e26e61552%40googlegroups.com)  
> [https://groups.google.com/d/msgid/elasticsearch/aa97c0bb-9c7c-444b-8e70-c70e26e61552%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/aa97c0bb-9c7c-444b-8e70-c70e26e61552%40googlegroups.com?utm_medium=email&utm_source=footer)  
> .  
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zuz0eUdDVU6EagCBc8ruk05xmiLFFCHeX7h3oAQAbQ3xA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zuz0eUdDVU6EagCBc8ruk05xmiLFFCHeX7h3oAQAbQ3xA%40mail.gmail.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:09am UTC](https://discuss.elastic.co/t/ability-to-filter-the-results-with-a-configurable-amount-of-lines-around-an-event/19206/3 "2017-07-06T01:09:30Z")

</div>


