# Can kibana compare logs from different area and find the missing one?

**URL:** https://discuss.elastic.co/t/can-kibana-compare-logs-from-different-area-and-find-the-missing-one/309509
**Category:** Kibana
**Created:** [July 13, 2022, 8:26am UTC](https://discuss.elastic.co/t/can-kibana-compare-logs-from-different-area-and-find-the-missing-one/309509 "2022-07-13T08:26:04Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![josephLiu](https://avatars.discourse-cdn.com/v4/letter/j/5f9b8f/32.png) [@josephLiu](https://discuss.elastic.co/u/josephLiu)
#### Post date: [July 13, 2022, 8:26am UTC](https://discuss.elastic.co/t/can-kibana-compare-logs-from-different-area-and-find-the-missing-one/309509/1 "2022-07-13T08:26:04Z")

</div>

I want to send some logs into elastic index continuous.  
When my program started logs will be sent into index1 .  
Finally some logs may lost and other logs will sent into index2

Can kibana compare 2 indexes and find the missing log automatically ?

---

<div class="post-metadata">

### Author: ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)
#### Post date: [July 13, 2022, 1:18pm UTC](https://discuss.elastic.co/t/can-kibana-compare-logs-from-different-area-and-find-the-missing-one/309509/2 "2022-07-13T13:18:33Z")

</div>

Hi, this is a duplicated post with [this](https://discuss.elastic.co/t/how-to-compare-data-to-find-missing-one/308924).

As I said, you need to compare each documents with aggregated result by your client side.

As elasticsearch is a distributed system, any supported query or aggregation performed on each shards individualy. The data flows from each data node (containing shards) to the coordinating node one-way. There is no supported query or aggregation which will distribute once aggregated results to each nodes again. This is also the reason why elasticsearch does not support JOIN function of general meaning.

---

<div class="post-metadata">

### Author: ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)
#### Post date: [July 13, 2022, 1:19pm UTC](https://discuss.elastic.co/t/can-kibana-compare-logs-from-different-area-and-find-the-missing-one/309509/3 "2022-07-13T13:19:22Z")

</div>

You might get convinced by searching something like "sub-query elasticsearch".

---

<div class="post-metadata">

### Author: ![josephLiu](https://avatars.discourse-cdn.com/v4/letter/j/5f9b8f/32.png) [@josephLiu](https://discuss.elastic.co/u/josephLiu)
#### Post date: [July 14, 2022, 2:31am UTC](https://discuss.elastic.co/t/can-kibana-compare-logs-from-different-area-and-find-the-missing-one/309509/4 "2022-07-14T02:31:00Z")

</div>

Thank you. I know the reason now 😀

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 11, 2022, 2:31am UTC](https://discuss.elastic.co/t/can-kibana-compare-logs-from-different-area-and-find-the-missing-one/309509/5 "2022-08-11T02:31:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
