Aggregating sequence of connected events

Lets say I have events like this in my log

{type:"approval_revokation", approval_id=22}
{type:"approval", request_id=12, approval_id=22}
{type:"control3", request_id=12}
{type:"control2", request_id=12}
{type:"control1", request_id=12}
{type:"request", request_id=12 requesting_user="user1"}
{type:"registration", userid="user1"}

I would like to do a search that aggregates one bucket for each approval containing all events connected to it as above. As you see there is not a single id field that can be used throughout the events, but they are all connected in a chain.

The reason I would like this is to feed this into a anomaly detector to verify things like that all controls where executed and validate registration event for a eventual approval.

Can this be done using aggregation or are there any other suggestion?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.