I am investigating windows security logs. One query has identified a set of logins which contain a field - "Logon ID". I would now like to have a second query chained/pipelined which finds all the log entries that contain the LogonID, partition/window by this parameter and show me the earliest entry and latest (how long the session lasted).
So,
Query 1 outputs fields "Logon ID",
Query 2 takes these logon IDs and outputs fields LogonID, EarliestbyLogonID and LatestByLogonID
Is this possible at all in ES or is it a case of plugins/download and analyse?
You should be able to do something with a query that looks like this (just replace the query with your query and timestamp with the field that stores the date of your log lines):
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.