# Conditional search in Lucene or Query DSL

**URL:** <https://discuss.elastic.co/t/conditional-search-in-lucene-or-query-dsl/276436>\
**Category:** Elasticsearch\
**Created:** [June 19, 2021, 1:15pm UTC](https://discuss.elastic.co/t/conditional-search-in-lucene-or-query-dsl/276436 "2021-06-19T13:15:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eric\_Barreto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eric_barreto/32/83050_2.png) [@Eric\_Barreto](https://discuss.elastic.co/u/Eric_Barreto)\
**Post date:** [June 19, 2021, 1:15pm UTC](https://discuss.elastic.co/t/conditional-search-in-lucene-or-query-dsl/276436/1 "2021-06-19T13:15:20Z")

</div>

Hi guys,

I'm trying to do a search via Lucene or Query DSL that does the following:

I have a log that contains several fields, among them the sourceIp and resourceKey fields. I need to create a survey that shows me all the logs where the same sourceIP brings more than 1 resourceKey value, the problem is that I don't know where to start.

Thanks

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 21, 2021, 8:45am UTC](https://discuss.elastic.co/t/conditional-search-in-lucene-or-query-dsl/276436/2 "2021-06-21T08:45:06Z")

</div>

hey,

can you share a sample document, and mapping, that would make it easier to come up with a proper query.

Thank you!

--Alex

---

<div class="post-metadata">

**Author:** ![Eric\_Barreto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eric_barreto/32/83050_2.png) [@Eric\_Barreto](https://discuss.elastic.co/u/Eric_Barreto)\
**Post date:** [June 21, 2021, 10:00am UTC](https://discuss.elastic.co/t/conditional-search-in-lucene-or-query-dsl/276436/3 "2021-06-21T10:00:58Z")

</div>

Thanks for answering @spinscale. Below is a sample of the log.  
What I need is to bring the sourceIPs that have + than x resourceKey values.

So it would be, if 1 IP connects to 1 or more resourceKey brings the result.

**@timestamp**  
**Jun 18, 2021 @ 18:28:43.040**

* * *

**@version**  
**1**

* * *

**\_id**  
**X5gGIXoBknzImTVfq8np**

* * *

**\_index**  
**xxxxxxxxxxxx**

* * *

**\_score**  
\*\* - \*\*

* * *

**\_type**  
**\_doc**

* * *

**apiKey**  
**xxxxxxxxxxxxx**

* * *

**application**  
**xxxxxxxxxxxxx**

* * *

**brand**  
**xxxxxxxxxxx**

* * *

**category**  
**xxxxxxxxxx**

* * *

**class**  
**xxxxxxxxxxx**

* * *

**cluster\_name**  
**team-checkout-pf**

* * *

**date**  
**Jun 18, 2021 @ 18:28:42.000**

* * *

**environment**  
**aws**

* * *

**file**  
**BaseExceptionHandlerControllerAdvice.java**

* * *

**headers.content\_length**  
**114051**

* * *

**headers.content\_type**  
**application/json**

* * *

**headers.http\_accept**  
\*\* - \*\*

* * *

**headers.http\_host**  
**xxxxxxxxxxxxxxxxxx**

* * *

**headers.http\_user\_agent**  
**Fluent-Bit**

* * *

**headers.http\_version**  
**HTTP/1.1**

* * *

**headers.request\_method**  
**POST**

* * *

**headers.request\_path**  
**/**

* * *

**headers.x\_amzn\_trace\_id**  
**xxxxxxxxxxxxx**

* * *

**headers.x\_forwarded\_for**  
**xxxxxxxxxxxxx**

* * *

**headers.x\_forwarded\_port**  
**443**

* * *

**headers.x\_forwarded\_proto**  
**https**

* * *

**host**  
**xxxxxxxxxxx**

* * *

**hostname**  
**xxxxxxxxxxxxxxxx**

* * *

**httpCode**  
**403**

* * *

**httpMethod**  
**POST**

* * *

**[kubernetes.annotations.cattle.io/timestamp](http://kubernetes.annotations.cattle.io/timestamp)**  
**Aug 21, 2020 @ 01:35:58.000**

* * *

**kubernetes.annotations.checksum/config**  
**e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855**

* * *

**kubernetes.annotations.checksum/secret**  
**dd043c802fd10d3a603b89e83c2e8b6c8b55b5e464be1c7303d0ac30e3016da3**

* * *

**[kubernetes.annotations.kubernetes.io/psp](http://kubernetes.annotations.kubernetes.io/psp)**  
**eks.privileged**

* * *

**[kubernetes.annotations.sidecar.istio.io/inject](http://kubernetes.annotations.sidecar.istio.io/inject)**  
**false**

* * *

**kubernetes.container\_hash**  
**xxxxxxxxxxxx**

* * *

**kubernetes.container\_image**  
**xxxxxxxxxxxx**

* * *

**kubernetes.container\_name**  
**customer-token**

* * *

**kubernetes.docker\_id**  
**e60d2a0c6496b01eb848104ebf7ef2ad0461629f9966219ee46599c266af2715**

* * *

**kubernetes.host**  
**xxxxxxxxxxx**

* * *

**kubernetes.labels.app**  
**customer-token-v1**

* * *

**kubernetes.labels.brand**  
**xxxxxxxxx**

* * *

**kubernetes.labels.chart**  
**deployment-1.26**

* * *

**kubernetes.labels.elbv2.k8s.aws/pod-readiness-gate-inject**  
**enabled**

* * *

**kubernetes.labels.flow**  
**pf**

* * *

**kubernetes.labels.heritage**  
**Tiller**

* * *

**kubernetes.labels.name**  
**xxxxxxxxx**

* * *

**kubernetes.labels.pod-template-hash**  
**5bdb6769b**

* * *

**kubernetes.labels.release**  
**xxxxxxxxxxxx**

* * *

**kubernetes.namespace\_name**  
**team-customer**

* * *

**kubernetes.pod\_id**  
**xxxxxxxxxxx**

* * *

**kubernetes.pod\_name**  
**xxxxxxxxxxx**

* * *

**line\_number**  
**113**

* * *

**log\_level**  
**ERROR**

* * *

**log\_message**  
**Nao foi possivel autenticar o cliente com o nome de usuario e senha informados. Login: garrastazuxxxx@xxxxxx.com.br**

* * *

**method**  
**handleServCorpException**

* * *

**referer**  
**UNKNOWN\_REFERER**

* * *

**resourceKey**  
**garrastazuxxxx@xxxxxx.com.br**

* * *

**service.name**  
**customer\_token**

* * *

**sourceIp**  
**222.XXX.92.XXX**

* * *

**thread\_name**  
**http-nio-8080-exec-4**

* * *

**throwable.exception\_class**  
**xxxxx**

* * *

**throwable.exception\_message**  
**Nao foi possivel autenticar o cliente com o nome de usuario e senha informados. Login: garrastazuxxx@xxxxx.com.br**

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 21, 2021, 10:07am UTC](https://discuss.elastic.co/t/conditional-search-in-lucene-or-query-dsl/276436/4 "2021-06-21T10:07:56Z")

</div>

Please take some more time to properly write up a problem statement and a minimal example. There is no index provided, no mapping, and no sample document in JSON format that others could use for testing. A multi page long sample document, where only 2 columns are needed out of 20 is also not helpful to understand the full context.

Also

> What I need is to bring the sourceIPs that have + than x resourceKey values.

is something that does not make too much sense to me. Coming up with a sample query (even if verbalized) plus a document that matched and also explaining when a document does not match would help a lot.

I know this require some more work up front, but otherwise getting help is **a lot harder** and community members will much more likely ignore your problem.

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 19, 2021, 10:08am UTC](https://discuss.elastic.co/t/conditional-search-in-lucene-or-query-dsl/276436/5 "2021-07-19T10:08:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.