# Chaining two queries, grouping and paritioning/windowing

**URL:** <https://discuss.elastic.co/t/chaining-two-queries-grouping-and-paritioning-windowing/95790>\
**Category:** Elasticsearch\
**Created:** [August 4, 2017, 12:28am UTC](https://discuss.elastic.co/t/chaining-two-queries-grouping-and-paritioning-windowing/95790 "2017-08-04T00:28:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![truekonrads](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/truekonrads/32/28104_2.png) [@truekonrads](https://discuss.elastic.co/u/truekonrads)\
**Post date:** [August 4, 2017, 12:28am UTC](https://discuss.elastic.co/t/chaining-two-queries-grouping-and-paritioning-windowing/95790/1 "2017-08-04T00:28:48Z")

</div>

Hello,

I am investigating windows security logs. One query has identified a set of logins which contain a field - "Logon ID". I would now like to have a second query chained/pipelined which finds all the log entries that contain the LogonID, partition/window by this parameter and show me the earliest entry and latest (how long the session lasted).

So,

- Query 1 outputs fields "Logon ID",
- Query 2 takes these logon IDs and outputs fields LogonID, EarliestbyLogonID and LatestByLogonID

Is this possible at all in ES or is it a case of plugins/download and analyse?

---

<div class="post-metadata">

**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\
**Post date:** [August 11, 2017, 7:59am UTC](https://discuss.elastic.co/t/chaining-two-queries-grouping-and-paritioning-windowing/95790/2 "2017-08-11T07:59:01Z")

</div>

You should be able to do something with a query that looks like this (just replace the query with your query and `timestamp` with the field that stores the date of your log lines):

```auto
GET logs/_search
{
  "size": 0,
  "query": "query that identifies interesting documents",
  "aggs": {
    "ids": {
      "terms": {
        "field": "LogonID"
      },
      "aggs": {
        "earliest_login": {
          "min": {
            "field": "timestamp"
          }
        },
        "latest_login": {
          "max": {
            "field": "timestamp"
          }
        },
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2017, 7:59am UTC](https://discuss.elastic.co/t/chaining-two-queries-grouping-and-paritioning-windowing/95790/3 "2017-09-08T07:59:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.