# Elasticsearch query with different fields **URL:** \ **Category:** Elasticsearch\ **Created:** [May 5, 2020, 1:49pm UTC](https://discuss.elastic.co/t/elasticsearch-query-with-different-fields/231166 "2020-05-05T13:49:59Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Guillaume\_RENARD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guillaume_renard/32/37369_2.png) [@Guillaume\_RENARD](https://discuss.elastic.co/u/Guillaume_RENARD)\ **Post date:** [May 5, 2020, 1:49pm UTC](https://discuss.elastic.co/t/elasticsearch-query-with-different-fields/231166/1 "2020-05-05T13:49:59Z")
Hi here an exemple of my documents ```auto { "@timestamp": "2020-04-24T19:36:52.484Z", "token": "123", "application": "sso_api_v3", "ssoapiv3_method": "GET", "ssoapiv3_error_description": "Your access token has expired", "code": 401, "message": "\"message\"", "level": 6, "facility": "sso_api_v3", "type": "gelf" } [...] { "@timestamp": "2020-04-24T19:37:52.484Z", "token": "123", "application": "sso_api_v3", "ssoapiv3_method": "GET", "ssoapiv3_error_description": "Your access token has expired", "code": 200, "message": "\"message\"", "level": 6, "facility": "sso_api_v3", "type": "gelf" } [...] ``` I have a huge amount of request and I would like to do a search in order to get documents with the **same token** but but with code 200,401, and then 200 again. I can get all 200, all 401 but I'm unable to get token with 200, then 401, then 200. Any help would be much appreciated ! ---
**Author:** ![psramkumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/psramkumar/32/31393_2.png) [@psramkumar](https://discuss.elastic.co/u/psramkumar)\ **Post date:** [May 5, 2020, 2:28pm UTC](https://discuss.elastic.co/t/elasticsearch-query-with-different-fields/231166/2 "2020-05-05T14:28:57Z")
not getting your problem, can you elaborate bit more. ---
**Author:** ![Guillaume\_RENARD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guillaume_renard/32/37369_2.png) [@Guillaume\_RENARD](https://discuss.elastic.co/u/Guillaume_RENARD)\ **Post date:** [May 5, 2020, 3:18pm UTC](https://discuss.elastic.co/t/elasticsearch-query-with-different-fields/231166/3 "2020-05-05T15:18:40Z")
Hi @psramkumar, Thanks for your interest. The context : we use a sso application using a token. When evetyhing's OK we only have 200, but sometimes we get 401 (unauthorized) and then 200 again and that's strange, so I want to get the token for which we have this behaviour. So I would like a way to get token with 200, then 401, then 200 again Thanks 🙂 ---
**Author:** ![psramkumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/psramkumar/32/31393_2.png) [@psramkumar](https://discuss.elastic.co/u/psramkumar)\ **Post date:** [May 5, 2020, 3:21pm UTC](https://discuss.elastic.co/t/elasticsearch-query-with-different-fields/231166/4 "2020-05-05T15:21:02Z")
so in that case return all and sort by the timestamp field, you will get what you looking for ---
**Author:** ![Guillaume\_RENARD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guillaume_renard/32/37369_2.png) [@Guillaume\_RENARD](https://discuss.elastic.co/u/Guillaume_RENARD)\ **Post date:** [May 5, 2020, 3:24pm UTC](https://discuss.elastic.co/t/elasticsearch-query-with-different-fields/231166/5 "2020-05-05T15:24:22Z")
Problem is I only want token with this scenario, I have to many documents to use my eyes to check and I'm not able to do a relevant query, not an expert yet of elasticsearch. I have ten of thousands different token, each with hundreds of query ---
**Author:** ![psramkumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/psramkumar/32/31393_2.png) [@psramkumar](https://discuss.elastic.co/u/psramkumar)\ **Post date:** [May 5, 2020, 3:30pm UTC](https://discuss.elastic.co/t/elasticsearch-query-with-different-fields/231166/6 "2020-05-05T15:30:56Z")
> [@Guillaume\_RENARD](#): > > my then in that case use Aggregation on Token field u will get the unique values also add size = 0, that way u can avoid the source. ---
**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Post date:** [May 5, 2020, 3:46pm UTC](https://discuss.elastic.co/t/elasticsearch-query-with-different-fields/231166/7 "2020-05-05T15:46:47Z")
As far as I know there is now way to accomplish that use case.. You can of course query for tokens that have 200 AND 401 responses. If all is sequential then is assumes that use case but assumptions are the mother of all F\*\*\* Up's so you need to come up with to verify that.. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 5, 2020, 3:53pm UTC](https://discuss.elastic.co/t/elasticsearch-query-with-different-fields/231166/8 "2020-05-05T15:53:07Z")
Looking for sequences of events typically requires a special entity-centric index in addition to the one you have got and can not be done by querying raw data. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 2, 2020, 3:53pm UTC](https://discuss.elastic.co/t/elasticsearch-query-with-different-fields/231166/9 "2020-06-02T15:53:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.