# Elasticsearch search query quide

**URL:** <https://discuss.elastic.co/t/elasticsearch-search-query-quide/305847>\
**Category:** Elasticsearch\
**Created:** [May 28, 2022, 9:53am UTC](https://discuss.elastic.co/t/elasticsearch-search-query-quide/305847 "2022-05-28T09:53:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Satya10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/satya10/32/98781_2.png) [@Satya10](https://discuss.elastic.co/u/Satya10)\
**Post date:** [May 28, 2022, 9:53am UTC](https://discuss.elastic.co/t/elasticsearch-search-query-quide/305847/1 "2022-05-28T09:53:59Z")

</div>

Currently, I'm working on **ELK 8** (Filebeat, Logstash, Elasticsearch & Kibana) stuck in the middle

The sample log is here,

```auto
2021-07-30 16:34:22 INFO com.example.OrderRest [fhxh750df392] Session opened OId 31324
2021-07-30 16:34:22 INFO com.example.OrderRest [fhxh750df392] Transaction started TId T312487
........
2021-07-30 16:34:22 INFO com.example.OrderRest [tegq842sh980] Session opened OId 31325
2021-07-30 16:34:22 INFO com.example.OrderRest [tegq842sh980] Transaction started TId T312488
........
2021-07-30 16:34:22 INFO com.example.OrderRest [fhxh750df392] Session closed
2021-07-30 16:34:22 INFO com.example.OrderRest [tegq842sh980] Session closed

```

**Issue:** If I query with **OId**  **31324** , getting only matching document as below

```auto
GET _search
{
  "query":{
    "match": {"OId": "31324"}
  }
}

```

result:

```auto
2021-07-30 16:34:22 INFO com.example.OrderRest [fhxh750df392] Session opened OId 31324

```

Instead, the result should also include transaction generated all next matching records with request id **fhxh750df392** like

```auto
2021-07-30 16:34:22 INFO com.example.OrderRest [fhxh750df392] Session opened OId 31324
2021-07-30 16:34:22 INFO com.example.OrderRest [fhxh750df392] Transaction started TId T312487
........
2021-07-30 16:34:22 INFO com.example.OrderRest [fhxh750df392] Session closed

```

Like, if I query with **TId**  **T312487** , result should be

```auto
2021-07-30 16:34:22 INFO com.example.OrderRest [fhxh750df392] Transaction started TId T312487
........
2021-07-30 16:34:22 INFO com.example.OrderRest [fhxh750df392] Session closed

```

I'm new to ELK can anyone guide me how to do

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 25, 2022, 9:54am UTC](https://discuss.elastic.co/t/elasticsearch-search-query-quide/305847/2 "2022-06-25T09:54:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.