# How to combine two logs and find part of common

**URL:** https://discuss.elastic.co/t/how-to-combine-two-logs-and-find-part-of-common/355069
**Category:** Kibana
**Tags:** elastic-stack-monitoring
**Created:** [March 8, 2024, 9:55pm UTC](https://discuss.elastic.co/t/how-to-combine-two-logs-and-find-part-of-common/355069 "2024-03-08T21:55:47Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![MR98](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@MR98](https://discuss.elastic.co/u/MR98)
#### Post date: [March 8, 2024, 9:55pm UTC](https://discuss.elastic.co/t/how-to-combine-two-logs-and-find-part-of-common/355069/1 "2024-03-08T21:55:47Z")

</div>

Hi all,  
I would like to create visualization based on search filter.  
I have two type of logs. Every log has two fields: message and objectID.

Log history for example:

```auto
Log1 - message: "MESSAGE.TEST.1" objectID: "123"
Log2 - message: "MESSAGE.ANOTHER.TEST.2" objectID: "123"
Log3 - message: "MESSAGE.TEST.1" objectID: "456"
Log4 - message: "MESSAGE.TEST.1" objectID: "789"
Log5 - message: "MESSAGE.ANOTHER.TEST.2" objectID: "789"
Log6 - message: "MESSAGE.TEST.1" objectID: "999"

```

I would like to have part of common where objectID has both messages as result . So in this example result should be 2 becouse only objectID: "789" and objectID: "123" had both messages in logs. How should I group it?

---

<div class="post-metadata">

### Author: ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)
#### Post date: [March 19, 2024, 7:57pm UTC](https://discuss.elastic.co/t/how-to-combine-two-logs-and-find-part-of-common/355069/2 "2024-03-19T19:57:12Z")

</div>

You can use the Transform feature of Elasticsearch to pivot the data into a new index that is entity-centric around objectID. A transform is a continuous process that keeps the destination index up-to-date as new data comes in.

You can learn more about the Transforms feature here: [https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-overview.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-overview.html)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 16, 2024, 7:58pm UTC](https://discuss.elastic.co/t/how-to-combine-two-logs-and-find-part-of-common/355069/3 "2024-04-16T19:58:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.