Filter in multiple docs

Elastic Stack Kibana
1

Hi,

I have an index that has a tracking by ID. For each step that id pass writes a DOC to elastic. But I'm
trying to make a filter that does the following validation.

It passed Step2 but did not pass at Step4.

Exemple:

ID: 123
STEP: A

ID: 123
STEP: B

ID:123
STEP:D

Filter: STEP:B AND NOT EXIST DOC WITH STEP:C
Return: ID: 123

2

It could be possible with bucket selector aggregation over ID and STEP terms aggregation. Note the max_buckets limitation.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.