# How to Correlate three events in EQL based on process and parent-process id?

**URL:** <https://discuss.elastic.co/t/how-to-correlate-three-events-in-eql-based-on-process-and-parent-process-id/316897>\
**Category:** Elastic Security\
**Tags:** eql-elastic-query-language\
**Created:** [October 18, 2022, 1:22pm UTC](https://discuss.elastic.co/t/how-to-correlate-three-events-in-eql-based-on-process-and-parent-process-id/316897 "2022-10-18T13:22:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sheharyar\_Khalid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sheharyar_khalid/32/112227_2.png) [@Sheharyar\_Khalid](https://discuss.elastic.co/u/Sheharyar_Khalid)\
**Post date:** [October 18, 2022, 1:22pm UTC](https://discuss.elastic.co/t/how-to-correlate-three-events-in-eql-based-on-process-and-parent-process-id/316897/1 "2022-10-18T13:22:44Z")

</div>

I have log data in the following format on elasticsearch:

1- ["process\_name":"nginx", "process\_id":"1", "parent\_process\_id":"0", "syscall":"execv"]  
2- ["process\_name":"python", "process\_id":"2", "parent\_process\_id":"1","syscall":"execv"]  
3- ["process\_name":"chrome", "process\_id":"3", "parent\_process\_id":"2","syscall":"execv"]

The three events are related based on their process\_id's and parent\_process\_id's. I am trying to write an EQL query to capture this chain of events. I have tried the following query:  
`"event_category_field" : "process_name" "query": """ sequence ["nginx" where syscall == "execv"] ["python" where syscall == "execv"] ["chrome" where syscall == "execv"] """`

> My goal is to join the first process i.e. "nginx" with "python" based on process\_id/parent\_process\_id (nginx-python) and join the second process ("python") with the third process ("chrome") based on process\_id/parent\_process\_id of (python-chrome).

**Is this possible to achieve using one query? Also, is there a way to aggregate two queries in one?**

**Is there any other way in elastic to capture this chain of events spanning three or more than three events?**

---

<div class="post-metadata">

**Author:** ![vitaliidm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliidm/32/101610_2.png) [@vitaliidm](https://discuss.elastic.co/u/vitaliidm)\
**Post date:** [October 20, 2022, 8:57am UTC](https://discuss.elastic.co/t/how-to-correlate-three-events-in-eql-based-on-process-and-parent-process-id/316897/2 "2022-10-20T08:57:40Z")

</div>

Hey @Sheharyar_Khalid, welcome to the community!

According to documentation:

> **[EQL syntax reference | Elasticsearch Guide \[master\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/master/eql-syntax.html#eql-compare-fields)**

> You cannot use EQL comparison operators to compare a field to another field. This applies even if the fields are changed using a function.

It's not possible to reference values from a previous sequence result in the next one.

> **Is there any other way in elastic to capture this chain of events spanning three or more than three events?**

Do you mean 3 or more event of the same type?

If it so, [with runs](https://www.elastic.co/guide/en/elasticsearch/reference/master/eql-syntax.html#eql-with-runs-statement) syntax should help:

> {  
> "event\_category\_field" : "process\_name",  
> "query": """  
> sequence by syscall  
> [nginx where syscall == "execv"]  
> [python where true] with runs=3  
> [chrome where true]  
> """  
> }

Thanks, Vitalii

---

<div class="post-metadata">

**Author:** ![Sheharyar\_Khalid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sheharyar_khalid/32/112227_2.png) [@Sheharyar\_Khalid](https://discuss.elastic.co/u/Sheharyar_Khalid)\
**Post date:** [October 20, 2022, 6:04pm UTC](https://discuss.elastic.co/t/how-to-correlate-three-events-in-eql-based-on-process-and-parent-process-id/316897/3 "2022-10-20T18:04:24Z")

</div>

Thank you for clarifying. As you mentioned I was trying to do this

> It's not possible to reference values from a previous sequence result in the next one.

Apparently it cannot be done.  
Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 17, 2022, 6:04pm UTC](https://discuss.elastic.co/t/how-to-correlate-three-events-in-eql-based-on-process-and-parent-process-id/316897/4 "2022-11-17T18:04:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.