# Elasticsearch Relations

**URL:** <https://discuss.elastic.co/t/elasticsearch-relations/76860>\
**Category:** Elasticsearch\
**Created:** [February 28, 2017, 7:53pm UTC](https://discuss.elastic.co/t/elasticsearch-relations/76860 "2017-02-28T19:53:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Conall\_Prendergast](https://avatars.discourse-cdn.com/v4/letter/c/d26b3c/32.png) [@Conall\_Prendergast](https://discuss.elastic.co/u/Conall_Prendergast)\
**Post date:** [February 28, 2017, 7:53pm UTC](https://discuss.elastic.co/t/elasticsearch-relations/76860/1 "2017-02-28T19:53:40Z")

</div>

Hi,

What is the best way to handle document associations in Elasticsearch.  
For example, to associate TCP packets in a stream together. \

Is it possible to query ES for, for example, SYN packets that dont have an "associated" SYN-ACK packet, and finally to get the count of suck packets...

New to ES so any help is appreciated..

Thanks

EDIT: Perhaps using an aggregator function in logstash to group the packets into a stream??

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2017, 7:53pm UTC](https://discuss.elastic.co/t/elasticsearch-relations/76860/2 "2017-03-28T19:53:41Z")

</div>

Closed on March 28, 2017, 7:53pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.