# Filtering logs based on the content of other logs in Kibana

**URL:** <https://discuss.elastic.co/t/filtering-logs-based-on-the-content-of-other-logs-in-kibana/204414>\
**Category:** Kibana\
**Created:** [October 21, 2019, 8:35am UTC](https://discuss.elastic.co/t/filtering-logs-based-on-the-content-of-other-logs-in-kibana/204414 "2019-10-21T08:35:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ernesta\_Duglas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ernesta_duglas/32/56233_2.png) [@Ernesta\_Duglas](https://discuss.elastic.co/u/Ernesta_Duglas)\
**Post date:** [October 21, 2019, 8:35am UTC](https://discuss.elastic.co/t/filtering-logs-based-on-the-content-of-other-logs-in-kibana/204414/1 "2019-10-21T08:35:12Z")

</div>

Hi,

I will pose this question on rather high level, but if you feel like you need more info and code samples to answer, please let me know and I'll try to provide it.  
So let's say I have the following logs in my Kibana:

```
{"infoMessage":"PENDING","orderNumber":"112233", "date":"2019-10-15"}
{"infoMessage":"PENDING","orderNumber":"12345", "date":"2019-10-15"}
{"infoMessage":"APPROVED","orderNumber":"12345", "date":"2019-10-16"}
{"infoMessage":"DECLINED","orderNumber":"54321", "date":"2019-10-16"}

```

I need to filter out only logs that have pending orders, meaning I should get only:  
`{ "infoMessage":"PENDING","orderNumber":"112233", "date":"2019-10-15"}`

I should not get  
`{"infoMessage":"PENDING","orderNumber":"12345", "date":"2019-10-15"}`  
since order 12345 was approved on 2019-10-16.

Thus is there a way to filter out the logs based on the content of other logs? Or maybe you have any ideas how could I achieve the above mentioned result?

I'm using Kibana 7.3

Many thanks!

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [October 25, 2019, 1:35pm UTC](https://discuss.elastic.co/t/filtering-logs-based-on-the-content-of-other-logs-in-kibana/204414/2 "2019-10-25T13:35:34Z")

</div>

First, just trying to frame the problem. If an order that was pending was declined, it still shouldn't be displayed in the results, right?

---

<div class="post-metadata">

**Author:** ![Ernesta\_Duglas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ernesta_duglas/32/56233_2.png) [@Ernesta\_Duglas](https://discuss.elastic.co/u/Ernesta_Duglas)\
**Post date:** [October 25, 2019, 8:44pm UTC](https://discuss.elastic.co/t/filtering-logs-based-on-the-content-of-other-logs-in-kibana/204414/3 "2019-10-25T20:44:55Z")

</div>

Yes, that's right.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2019, 8:47pm UTC](https://discuss.elastic.co/t/filtering-logs-based-on-the-content-of-other-logs-in-kibana/204414/4 "2019-11-22T20:47:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.