# Analyzing for missing count

**URL:** https://discuss.elastic.co/t/analyzing-for-missing-count/125556
**Category:** Elasticsearch
**Created:** [March 26, 2018, 7:14am UTC](https://discuss.elastic.co/t/analyzing-for-missing-count/125556 "2018-03-26T07:14:11Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![shwesinhan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shwesinhan/32/78663_2.png) [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)
#### Post date: [March 26, 2018, 7:14am UTC](https://discuss.elastic.co/t/analyzing-for-missing-count/125556/1 "2018-03-26T07:14:11Z")

</div>

hi there

let me ask one thing.

my scenario is that

let's say i have 3 requests to A system and i expected 3 responses from A system.  
but in real i got 2 responses from A system.  
one response was dropout.  
probably, user close browser while A system was progressing....

eg raw msg:

```
2017-12-19 09:25:50,207 (null) 27 Info : ASystem : TESTPAGE :: elkko5zhjzyigt4it1wjmxpw :: Request : <UserRequest><version>9.0</version><RefID>764764000000881</RefID></UserRequest>
2017-12-19 09:25:50,207 (null) 27 Info : ASystem : TESTPAGE :: elkko5zhjzyigt4it1wjmxpw :: Response: <UserResponse><version>9.0</version><RefID>764764000000881</RefID></UserResponse>

```

`2017-12-19 09:26:50,207 (null) 27 Info : ASystem : TESTPAGE :: elkko5zhjzyigt4it1wjmxpw :: Request : <UserRequest><version>9.0</version><RefID>764764000000882</RefID></UserRequest>`

```
2017-12-19 09:27:50,207 (null) 27 Info : ASystem : TESTPAGE :: elkko5zhjzyigt4it1wjmxpw :: Request : <UserRequest><version>9.0</version><RefID>764764000000883</RefID></UserRequest>
2017-12-19 09:27:50,207 (null) 27 Info : ASystem : TESTPAGE :: elkko5zhjzyigt4it1wjmxpw :: Response: <UserResponse><version>9.0</version><RefID>764764000000883</RefID></UserResponse>

```

Above A system logs stream to logstash  
Then logstash make some fields using grok patterns.

eg fields:

> log\_timestamp: 2017-12-19 09:27:50,207  
> log\_level: Info  
> log\_type: REQUEST \*if log msg have Request then log\_type: REQUEST  
> log\_type: RESPONSE \*if log msg have Response then log\_type: RESPONSE  
> ref\_id: 764764000000883  
> version: 9.0

In Request and Response logs, there is no response log found in second request?  
My question is that how to query for missing response log count (dropout) in elasticsearch????

Any advise would be appreciated

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 23, 2018, 7:17am UTC](https://discuss.elastic.co/t/analyzing-for-missing-count/125556/2 "2018-04-23T07:17:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.