# How to combine search results

**URL:** https://discuss.elastic.co/t/how-to-combine-search-results/271730
**Category:** Elasticsearch
**Created:** [April 30, 2021, 1:10am UTC](https://discuss.elastic.co/t/how-to-combine-search-results/271730 "2021-04-30T01:10:41Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Ruth\_Smith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruth_smith/32/87244_2.png) [@Ruth\_Smith](https://discuss.elastic.co/u/Ruth_Smith)
#### Post date: [April 30, 2021, 1:10am UTC](https://discuss.elastic.co/t/how-to-combine-search-results/271730/1 "2021-04-30T01:10:41Z")

</div>

I'm using ES 7.1.2. I have indices of log records of customer logins, one index per day. I want to find a list of all customers who have not logged in the prior month. I know how to execute two aggregations, one which returns a unique list of all customers searching all indices, and one which returns the same thing but searching just the prior month's indices. What i need to do is take the difference between these two lists. I can easily do this in python, sending two GET requests and processing the results. But I want to do this so that I can display the result in Kibana, so I was hoping to use a painless script. I'm new to painless scripting and looking through the documentation I don't see any examples like this. Is this possible?

---

<div class="post-metadata">

### Author: ![pythonic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pythonic/32/100950_2.png) [@pythonic](https://discuss.elastic.co/u/pythonic)
#### Post date: [May 2, 2021, 6:22am UTC](https://discuss.elastic.co/t/how-to-combine-search-results/271730/3 "2021-05-02T06:22:03Z")

</div>

Hello Ruth,

I think you can do using Kibana also, create an index pattern for your daily created index, and then try to create the visualization on top of it.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 30, 2021, 6:22am UTC](https://discuss.elastic.co/t/how-to-combine-search-results/271730/4 "2021-05-30T06:22:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
