# Chain of queries

**URL:** <https://discuss.elastic.co/t/chain-of-queries/86514>\
**Category:** Elasticsearch\
**Created:** [May 20, 2017, 7:05am UTC](https://discuss.elastic.co/t/chain-of-queries/86514 "2017-05-20T07:05:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eduard\_Kolesnikov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eduard_kolesnikov/32/18183_2.png) [@Eduard\_Kolesnikov](https://discuss.elastic.co/u/Eduard_Kolesnikov)\
**Post date:** [May 20, 2017, 7:05am UTC](https://discuss.elastic.co/t/chain-of-queries/86514/1 "2017-05-20T07:05:58Z")

</div>

Hi, I have a problem with building a log search query.  
Let's say I have logs with mandatory fields "name" and "car", and an optional field "color". Suppose that car of the same brand can not be of different colors. For example, if at least one person has a Porsche of white color, hence all Porsche owners have a white color.  
I want to find all the logs for a particular color. I will remind you that some logs do not have a "color" field, but you can determine the color by finding another log with the same brand of car.  
How should I build a log search query ?.  
Example:  
{"name":"Jhon" , "car":"Porsche", "color": "red"}  
{"name":"Bob" , "car":"Ferrari", "color": "red"}  
{"name":"William" , "car":"Ferrari"}  
{"name":"Konstantin" , "car":"Porsche"}  
{"name":"Carl" , "car":"BMW", "color": "white"}  
When searching for a red color I should get  
{"name":"Jhon" , "car":"Porsche", "color": "red"}  
{"name":"Bob" , "car":"Ferrari", "color": "red"}  
{"name":"William" , "car":"Ferrari"}  
{"name":"Konstantin" , "car":"Porsche"}  
p.s. sorry for my english

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 20, 2017, 8:35am UTC](https://discuss.elastic.co/t/chain-of-queries/86514/2 "2017-05-20T08:35:09Z")

</div>

You are pretty much looking at a join with this, which you cannot do in ES.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 17, 2017, 8:35am UTC](https://discuss.elastic.co/t/chain-of-queries/86514/3 "2017-06-17T08:35:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.