# How to execute dynamic queries with visualisations

**URL:** <https://discuss.elastic.co/t/how-to-execute-dynamic-queries-with-visualisations/281640>\
**Category:** Kibana\
**Created:** [August 17, 2021, 8:10am UTC](https://discuss.elastic.co/t/how-to-execute-dynamic-queries-with-visualisations/281640 "2021-08-17T08:10:35Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![nsouth](https://avatars.discourse-cdn.com/v4/letter/n/ecccb3/32.png) [@nsouth](https://discuss.elastic.co/u/nsouth)\
**Post date:** [August 19, 2021, 3:25pm UTC](https://discuss.elastic.co/t/how-to-execute-dynamic-queries-with-visualisations/281640/8 "2021-08-19T15:25:10Z")

</div>

Just to add to the discussion, I've recently been looking into options for doing calculations across events/documents. I've come across the following options, although I don't have a wealth of direct experience in any of them.

1. [Logstash Aggregate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html) - Can piece together related events and saves a single event after the final event has been detected (or timed out). Has some scaling concerns.
2. [Logstash Elasticsearch filter and elasticsearch output](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elasticsearch.html#plugins-filters-elasticsearch-index) - Logstash can query elasticsearch for a previously-ingested event/document, use its fields to calculate something new, and then update the original document.
3. [Elasticsearch Transforms](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html) - After events have been ingested, transform them into an entity-centric index using the Transforms feature. I'm not sure how much delay you can expect from this post-processing, but Transforms can run in continuous mode, so in theory it can be fairly minimal.

Anyone, feel free to correct me on anything. There's also some good discussion here:

> [@Using painless to calculate durations](https://discuss.elastic.co/t/using-painless-to-calculate-durations/119495/7):
>
> Actually, the default according to documentation is 1800 seconds (30 minutes). Mine needs to span 24 hours as some of the events I am tracking are long running.

---

_[View the full topic](https://discuss.elastic.co/t/how-to-execute-dynamic-queries-with-visualisations/281640)._