# Find the same events from different environments

**URL:** <https://discuss.elastic.co/t/find-the-same-events-from-different-environments/217836>\
**Category:** Elasticsearch\
**Created:** [February 4, 2020, 2:41pm UTC](https://discuss.elastic.co/t/find-the-same-events-from-different-environments/217836 "2020-02-04T14:41:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Artem\_Nikitin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artem_nikitin/32/42859_2.png) [@Artem\_Nikitin](https://discuss.elastic.co/u/Artem_Nikitin)\
**Post date:** [February 4, 2020, 2:41pm UTC](https://discuss.elastic.co/t/find-the-same-events-from-different-environments/217836/1 "2020-02-04T14:41:47Z")

</div>

Our data in ES looks like:  
{ "event": "w", "environment": "abc"}  
{ "event": "w", "environment": "def"}  
{ "event": "z", "environment": "abc"}  
ES version is 6.5.1

I want to find all the events which happened in more than 1 environment. In the example it should be event "w" only because it's happened in both "abc" and "def" environments.

Can I query it from ES in that way?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 5, 2020, 9:56am UTC](https://discuss.elastic.co/t/find-the-same-events-from-different-environments/217836/2 "2020-02-05T09:56:34Z")

</div>

I suppose that each line is an own document: Then you could use a terms aggregation on the `environment` field.

---

<div class="post-metadata">

**Author:** ![Artem\_Nikitin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artem_nikitin/32/42859_2.png) [@Artem\_Nikitin](https://discuss.elastic.co/u/Artem_Nikitin)\
**Post date:** [February 5, 2020, 12:35pm UTC](https://discuss.elastic.co/t/find-the-same-events-from-different-environments/217836/3 "2020-02-05T12:35:30Z")

</div>

It works!  
Thank you, Alexander

---

<div class="post-metadata">

**Author:** ![Artem\_Nikitin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artem_nikitin/32/42859_2.png) [@Artem\_Nikitin](https://discuss.elastic.co/u/Artem_Nikitin)\
**Post date:** [March 4, 2020, 12:35pm UTC](https://discuss.elastic.co/t/find-the-same-events-from-different-environments/217836/4 "2020-03-04T12:35:45Z")

</div>

Closed on March 4, 2020, 12:35pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.