# Displaying data from one event to other events **URL:** \ **Category:** Kibana\ **Created:** [October 2, 2021, 5:02pm UTC](https://discuss.elastic.co/t/displaying-data-from-one-event-to-other-events/285747 "2021-10-02T17:02:18Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![mostafaelsayed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mostafaelsayed/32/82057_2.png) [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)\ **Post date:** [October 2, 2021, 5:02pm UTC](https://discuss.elastic.co/t/displaying-data-from-one-event-to-other-events/285747/1 "2021-10-02T17:02:18Z")
Hello All Is there a way in kibana to display fields from one event to other related events in data tables aggregations and discover views? for example, 2 events with this format: ```auto 1. { id: 1, city: 'London', temperature : '20', //.....other fields.../ } 2. { id: 1, city: 'London', //.....other fields... (except temperature) // } ``` and I want to display the temperature for the second event given that the events are linked through the id field Is there a way to do that in kibana? I searched and found the only way is by de-normalizing the data and propagate the temperature to the other events but the problem is we don't want to control the data from the source system Also I tried using logstash for that but the events are not guaranteed to come in specific order and the rate of the events are high so accessing Elasticsearch to get the required data and populate it is also not guaranteed because the event may still not been indexed I thought the only way is to use another UI framework and control what data to retrieve and what to display (by using a backend layer on top of it to do that) Any suggestions? Thank You ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [October 2, 2021, 5:15pm UTC](https://discuss.elastic.co/t/displaying-data-from-one-event-to-other-events/285747/2 "2021-10-02T17:15:14Z")
You can ask logstash Elasticsearch output plugin to join the 2 events into the same event with \_id = 1 and fields city & temperature ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [October 2, 2021, 5:17pm UTC](https://discuss.elastic.co/t/displaying-data-from-one-event-to-other-events/285747/3 "2021-10-02T17:17:12Z")
Something like this ```auto output { elasticsearch { hosts => "***" user => "***" password => "***" index => "***" document_id => "%{[id]}" action => "update" doc_as_upsert => true } } ``` ---
**Author:** ![mostafaelsayed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mostafaelsayed/32/82057_2.png) [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)\ **Post date:** [October 2, 2021, 5:31pm UTC](https://discuss.elastic.co/t/displaying-data-from-one-event-to-other-events/285747/4 "2021-10-02T17:31:15Z")
But I want to keep all the events separate to be able to display the other fields in separate rows (those other fields may differ from one event to another for the same id but the temperature and city will always be the same for the same id) ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [October 2, 2021, 6:09pm UTC](https://discuss.elastic.co/t/displaying-data-from-one-event-to-other-events/285747/5 "2021-10-02T18:09:42Z")
It's not clear your use case, can you provide a concrete example ? ---
**Author:** ![mostafaelsayed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mostafaelsayed/32/82057_2.png) [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)\ **Post date:** [October 2, 2021, 6:44pm UTC](https://discuss.elastic.co/t/displaying-data-from-one-event-to-other-events/285747/6 "2021-10-02T18:44:12Z")
I was trying to simplify the use case with an example but the example may seem unrealistic so I will explain again with the actual case we have we have two events below ```auto 1. { shipmentId: 1, trailerId: 10, eventName: ShipmentLoaded, eventTimestamp: 2021-10-01T10:00:00 } ``` ```auto 2. { shipmentId: 1, eventName: ShipmentPrepared, eventTimestamp: 2021-10-01T10:00:05 } ``` we know for a fact that any event with name "ShipmentLoaded" will always have "trailerId" field And one trailer may contain multiple shipments so the second event (which is having the same shipmentId as the first event) is also belonging to trailerId 10. But this second event is coming from the source system without this trailerId field in it so I want to show a data table like this: ```auto id trailer id eventName eventTimestamp 1 10 ShipmentLoaded 2021-10-01T10:00:00 1 10 ShipmentPrepared 2021-10-01T10:00:05 ``` ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [October 2, 2021, 6:53pm UTC](https://discuss.elastic.co/t/displaying-data-from-one-event-to-other-events/285747/7 "2021-10-02T18:53:46Z")
Does this make sens ? ```auto id trailer id ShipmentLoaded_time ShipmentPrepared_time 1 10 2021-10-01T10:00:00 2021-10-01T10:00:05 ``` ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [October 2, 2021, 6:55pm UTC](https://discuss.elastic.co/t/displaying-data-from-one-event-to-other-events/285747/8 "2021-10-02T18:55:50Z")
I'm thinking about [tranform](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html) that will allow you to have an entity centric index around shipments ---
**Author:** ![mostafaelsayed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mostafaelsayed/32/82057_2.png) [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)\ **Post date:** [October 2, 2021, 7:25pm UTC](https://discuss.elastic.co/t/displaying-data-from-one-event-to-other-events/285747/9 "2021-10-02T19:25:01Z")
Thanks I will look into that So for that use case the only possible tables we can get are summary tables, not detailed ones? ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [October 2, 2021, 7:28pm UTC](https://discuss.elastic.co/t/displaying-data-from-one-event-to-other-events/285747/10 "2021-10-02T19:28:20Z")
Since the lifecyle of a shipment is limited i guess, a shipment can goes through a limited number of steps, a entity centric index may be the good approach for that use case You can explore other scenarios of enrichiment using Elasticsearch filter in logstash but may not be scalable ---
**Author:** ![mostafaelsayed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mostafaelsayed/32/82057_2.png) [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)\ **Post date:** [October 2, 2021, 7:42pm UTC](https://discuss.elastic.co/t/displaying-data-from-one-event-to-other-events/285747/11 "2021-10-02T19:42:19Z")
Thank you. I will explore the entity centric option ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 30, 2021, 7:42pm UTC](https://discuss.elastic.co/t/displaying-data-from-one-event-to-other-events/285747/12 "2021-10-30T19:42:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.