# How to combine ES query

**URL:** <https://discuss.elastic.co/t/how-to-combine-es-query/118211>\
**Category:** Elasticsearch\
**Created:** [February 2, 2018, 10:29am UTC](https://discuss.elastic.co/t/how-to-combine-es-query/118211 "2018-02-02T10:29:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![r.ganeshbabu](https://avatars.discourse-cdn.com/v4/letter/r/4da419/32.png) [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\
**Post date:** [February 2, 2018, 10:29am UTC](https://discuss.elastic.co/t/how-to-combine-es-query/118211/1 "2018-02-02T10:29:33Z")

</div>

Hi All,

I am using Elasticsearch 5.6.4 version for my application and I want to write ES query for the following use case,

Let’s say I have an index in elasticsearch called as “winlogbeat”

From the index I am having one field has “event\_id” and it has two values 299 & 500. In during search if I use the event\_id 299 I will get the list of site informations and instance\_id, if I use the event\_id 500 I will get the username & instance\_id and important thing is both instance\_id are same in the response.

I want to combine these two in single query and find which user has successfully logged in with respect to each site.

Please kindly share any thoughts and it would be very helpful.

Regards,  
Ganeshbabu R

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 2, 2018, 10:29am UTC](https://discuss.elastic.co/t/how-to-combine-es-query/118211/2 "2018-03-02T10:29:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.