# Group by field and remove a complete group if it contains a certain value in a second field

**URL:** <https://discuss.elastic.co/t/group-by-field-and-remove-a-complete-group-if-it-contains-a-certain-value-in-a-second-field/202772>\
**Category:** Kibana\
**Created:** [October 9, 2019, 6:48am UTC](https://discuss.elastic.co/t/group-by-field-and-remove-a-complete-group-if-it-contains-a-certain-value-in-a-second-field/202772 "2019-10-09T06:48:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jo\_Hoffmann](https://avatars.discourse-cdn.com/v4/letter/j/258eb7/32.png) [@Jo\_Hoffmann](https://discuss.elastic.co/u/Jo_Hoffmann)\
**Post date:** [October 9, 2019, 6:48am UTC](https://discuss.elastic.co/t/group-by-field-and-remove-a-complete-group-if-it-contains-a-certain-value-in-a-second-field/202772/1 "2019-10-09T06:48:49Z")

</div>

Hello there,  
we are testing some Kibana usecases and of course I got some problems I'm not able to solve right now.

We are logging printed documents and their lifetime in json format. Each application ( 5 overall) the document passes, sends a json message to elasticsearch.  
In a simplified view, we have as fields a doc\_id, which is the unique identifier for a single document. Each json message from the applications contains this doc\_id.  
As second field we have a field called outmode, which represents the application, which the document has passed.

As example for a document lifecycle:  
doc\_id: 1234

Message from application 1 contains:  
doc\_id = 1234  
outmode = application\_1

Message from application 2 contains:  
doc\_id = 1234  
outmode = application\_2

Message from application 3 contains:  
doc\_id = 1234  
outmode = application\_3

Message from application 4 contains:  
doc\_id = 1234  
outmode = application\_4

Message from application 5 contains:  
doc\_id = 1234  
outmode = application\_5

The target is, to see all documents, which passed a certain number of applications, for example application\_1 to application\_3.  
The documents which have proceeded further then application\_3 should not be displayed.  
The documents which have passed application\_1 and application\_2, but not application\_3 should not be displayed as well.

For any additional information, don't hesitate to ask.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2019, 6:48am UTC](https://discuss.elastic.co/t/group-by-field-and-remove-a-complete-group-if-it-contains-a-certain-value-in-a-second-field/202772/2 "2019-11-06T06:48:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.