Find the same events from different environments

Elastic Stack Elasticsearch
1

Our data in ES looks like:
{ "event": "w", "environment": "abc"}
{ "event": "w", "environment": "def"}
{ "event": "z", "environment": "abc"}
ES version is 6.5.1

I want to find all the events which happened in more than 1 environment. In the example it should be event "w" only because it's happened in both "abc" and "def" environments.

Can I query it from ES in that way?

2

I suppose that each line is an own document: Then you could use a terms aggregation on the environment field.

3

It works!
Thank you, Alexander

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.