# Complicated filter/aggregation based on an ID excluding CREARED from REVIEVED alerts **URL:** \ **Category:** Kibana\ **Created:** [November 30, 2015, 10:46am UTC](https://discuss.elastic.co/t/complicated-filter-aggregation-based-on-an-id-excluding-creared-from-revieved-alerts/35882 "2015-11-30T10:46:33Z")\ **Posts on this page:** 1\ **Showing post:** 3
**Author:** ![NilsBecker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nilsbecker/32/6243_2.png) [@NilsBecker](https://discuss.elastic.co/u/NilsBecker)\ **Post date:** [December 1, 2015, 7:08am UTC](https://discuss.elastic.co/t/complicated-filter-aggregation-based-on-an-id-excluding-creared-from-revieved-alerts/35882/3 "2015-12-01T07:08:52Z")
I have used [this solution](https://discuss.elastic.co/t/kibana-charts-with-only-latest-entry/32423/3?u=nilsbecker) for another visualization but here I can't. In my example you can see more than one alert can have the same ALERT\_ID (because the same "Rule" caused the errors). If I use the ALERT\_ID as ID in Elasticsearch, I'm not abel to see all alerts. And in want to see all alerts, also the allready cleared in a visualization which showas how many alerts I had in the last few hours/days (Line chart). --- _[View the full topic](https://discuss.elastic.co/t/complicated-filter-aggregation-based-on-an-id-excluding-creared-from-revieved-alerts/35882)._