I am investigating windows security logs. One query has identified a set of logins which contain a field - "Logon ID". I would now like to have a second query chained/pipelined which finds all the log entries that contain the LogonID, partition/window by this parameter and show me the earliest entry and latest (how long the session lasted).
- Query 1 outputs fields "Logon ID",
- Query 2 takes these logon IDs and outputs fields LogonID, EarliestbyLogonID and LatestByLogonID
Is this possible at all in ES or is it a case of plugins/download and analyse?