# Chaining saved searches

**URL:** <https://discuss.elastic.co/t/chaining-saved-searches/35850>\
**Category:** Kibana\
**Created:** [November 30, 2015, 2:11am UTC](https://discuss.elastic.co/t/chaining-saved-searches/35850 "2015-11-30T02:11:03Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![treehouse](https://avatars.discourse-cdn.com/v4/letter/t/e9a140/32.png) [@treehouse](https://discuss.elastic.co/u/treehouse)\
**Post date:** [November 30, 2015, 2:11am UTC](https://discuss.elastic.co/t/chaining-saved-searches/35850/1 "2015-11-30T02:11:03Z")

</div>

hey guys

I am frequently coming up with a use case for chaining saved searches and wonder if it is possible or whether will require a PR. Use case --

I have a base saved search query that filters bot traffic from nginx logs, lets say it looks like this`-user_agent: (ELB-HealthChecker*)`, in reality it is much longer. I have another search query that gets requests to the home page `request: "/"`, much longer again this is just illustrative. Now I would like to chain these two search queries instead of mashing them into one super query.

I guess it would be modular query building.. would be really nice to have this. Any thoughts would be awesome.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 30, 2015, 2:33am UTC](https://discuss.elastic.co/t/chaining-saved-searches/35850/2 "2015-11-30T02:33:32Z")

</div>

You can't currently with Kibana.  
Elasticsearch has pipeline aggs that may suit what you are after, but it's not built into KB as yet.

---

<div class="post-metadata">

**Author:** ![treehouse](https://avatars.discourse-cdn.com/v4/letter/t/e9a140/32.png) [@treehouse](https://discuss.elastic.co/u/treehouse)\
**Post date:** [November 30, 2015, 2:39am UTC](https://discuss.elastic.co/t/chaining-saved-searches/35850/3 "2015-11-30T02:39:47Z")

</div>

Hmm could be some confusion. I am familiar with pipeline aggs, not sure if this is what I'm after though. Essentially I want to be able to say:

search: `S1 AND S2`

as opposed to

search: `-user_agent: (ELB-HealthChecker*) AND request: "/"`

No new functionality is required on elasticsearch side. It would just make things a bit cleaner on the Kibana side of things. Lets say I use S1 with S2, S3 and S4 all in their own different searches, not together, but separately.

search: `S1 AND S2`  
search: `S1 AND S3`  
search: `S1 AND S4`

and I want to modify S1.. instead of having to modify every search, I would just modify S1 and it would be applied to every search.

---

<div class="post-metadata">

**Author:** ![Pieter\_Agenbag](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pieter_agenbag/32/4562_2.png) [@Pieter\_Agenbag](https://discuss.elastic.co/u/Pieter_Agenbag)\
**Post date:** [November 30, 2015, 1:08pm UTC](https://discuss.elastic.co/t/chaining-saved-searches/35850/4 "2015-11-30T13:08:30Z")

</div>

Its not possible - but I think it has been requested before - there might be a GIT issue you can +1.  
Personally I think it would be a very useful feature - I have added this to my application, which embeds Kibana dashboards , then I just build up the query string on my side and pass it through to Kibana via the URL parameters.

---

<div class="post-metadata">

**Author:** ![treehouse](https://avatars.discourse-cdn.com/v4/letter/t/e9a140/32.png) [@treehouse](https://discuss.elastic.co/u/treehouse)\
**Post date:** [November 30, 2015, 9:06pm UTC](https://discuss.elastic.co/t/chaining-saved-searches/35850/5 "2015-11-30T21:06:36Z")

</div>

interesting, thanks for the note!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 30, 2015, 9:13pm UTC](https://discuss.elastic.co/t/chaining-saved-searches/35850/6 "2015-11-30T21:13:32Z")

</div>

Please feel free to raise an feature request for this 😃

---

<div class="post-metadata">

**Author:** ![treehouse](https://avatars.discourse-cdn.com/v4/letter/t/e9a140/32.png) [@treehouse](https://discuss.elastic.co/u/treehouse)\
**Post date:** [November 30, 2015, 10:58pm UTC](https://discuss.elastic.co/t/chaining-saved-searches/35850/7 "2015-11-30T22:58:39Z")

</div>

For reference: [https://github.com/elastic/kibana/issues/5535](https://github.com/elastic/kibana/issues/5535)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:07pm UTC](https://discuss.elastic.co/t/chaining-saved-searches/35850/8 "2017-07-06T14:07:50Z")

</div>


