# ES comprehensive searches over different logs
**URL:** https://discuss.elastic.co/t/es-comprehensive-searches-over-different-logs/22549
**Category:** Elasticsearch
**Created:** [March 6, 2015, 11:32am UTC](https://discuss.elastic.co/t/es-comprehensive-searches-over-different-logs/22549 "2015-03-06T11:32:30Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@german23](https://discuss.elastic.co/u/german23)
#### Post date: [March 6, 2015, 11:32am UTC](https://discuss.elastic.co/t/es-comprehensive-searches-over-different-logs/22549/1 "2015-03-06T11:32:30Z")
Hey guys,
we are acutally setting up some security relevant searches in our
ES-database and came over the following case, which i dont get managed by
myself:
We want to make an query, that checks if a IP-address is accessing
different ports in a given amout of time.
So what we basically need to do is, make a terms aggregation on a field
called "remote\_ip" and match the terms with an filter/query like "port:XXX
AND port:XXY AND port:XXZ" but that query must go over different logs
(port:XXX is in log1, port:XXZ is in log2).
So that query should return all remote\_ips that have accessed all 3 ports
in the given time.
I really struggle with that log-comprehensive searches, cause im not that
fit in aggregation yet.
Some tipps would be really appreciated.
Thanks
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/220ed49b-5cf6-45cf-879b-10acecacc36e%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/220ed49b-5cf6-45cf-879b-10acecacc36e%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 6, 2015, 9:03pm UTC](https://discuss.elastic.co/t/es-comprehensive-searches-over-different-logs/22549/2 "2015-03-06T21:03:50Z")
The "port:XXX AND port:XXY AND port:XXZ" will give you the results, you can
then agg on IP on top of that.
I'd suggest you install Kibana4 and then get a table/chart that gives you
the output you want and then use the inspect functionality (the I on a
panel) to see the query it used to get the data.
On 6 March 2015 at 22:32, horst knete [baduncle23@hotmail.de](mailto:baduncle23@hotmail.de) wrote:
> Hey guys,
>
> we are acutally setting up some security relevant searches in our
> ES-database and came over the following case, which i dont get managed by
> myself:
>
> We want to make an query, that checks if a IP-address is accessing
> different ports in a given amout of time.
>
> So what we basically need to do is, make a terms aggregation on a field
> called "remote\_ip" and match the terms with an filter/query like "port:XXX
> AND port:XXY AND port:XXZ" but that query must go over different logs
> (port:XXX is in log1, port:XXZ is in log2).
>
> So that query should return all remote\_ips that have accessed all 3 ports
> in the given time.
>
> I really struggle with that log-comprehensive searches, cause im not that
> fit in aggregation yet.
>
> Some tipps would be really appreciated.
>
> Thanks
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/220ed49b-5cf6-45cf-879b-10acecacc36e%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/220ed49b-5cf6-45cf-879b-10acecacc36e%40googlegroups.com)
> [https://groups.google.com/d/msgid/elasticsearch/220ed49b-5cf6-45cf-879b-10acecacc36e%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/220ed49b-5cf6-45cf-879b-10acecacc36e%40googlegroups.com?utm_medium=email&utm_source=footer)
> .
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-tr6vBSeRLnCdCOFxecuH3qi3%2BBk4MG%3D%3Dw7%2BVL7FW%3DgA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-tr6vBSeRLnCdCOFxecuH3qi3%2BBk4MG%3D%3Dw7%2BVL7FW%3DgA%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:27am UTC](https://discuss.elastic.co/t/es-comprehensive-searches-over-different-logs/22549/3 "2017-07-06T00:27:57Z")