# How to fetch a field value in an elasticsearch document and then parse other documents based on this same value **URL:** \ **Category:** Elasticsearch\ **Created:** [February 25, 2016, 10:08am UTC](https://discuss.elastic.co/t/how-to-fetch-a-field-value-in-an-elasticsearch-document-and-then-parse-other-documents-based-on-this-same-value/42690 "2016-02-25T10:08:46Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![jpry](https://avatars.discourse-cdn.com/v4/letter/j/ecae2f/32.png) [@jpry](https://discuss.elastic.co/u/jpry)\ **Post date:** [February 25, 2016, 10:08am UTC](https://discuss.elastic.co/t/how-to-fetch-a-field-value-in-an-elasticsearch-document-and-then-parse-other-documents-based-on-this-same-value/42690/1 "2016-02-25T10:08:46Z")
I've got several lines of logs forwarded to Elasticsearch. One line of log corresponds to one ES document. Each line is identified by a connection session id, and a connection session is described by several lines of logs. E.g. assume a connection session is identified by the following id: f788i7b0. The same connection session is described by the following logs: Feb 16 17:15:07 slot1/APM notice tmm1[11112]: 01490500:5: f788i7b0: New session from client IP 8.8.8.8 (ST=/CC=/C=) at VIP 9.9.9.9 Listener /Common/vs\_stack.com (Reputation=Unknown) Feb 16 17:15:07 slot1/APM notice apd[5515]: 01490010:5: f788i7b0: Username '[stack.com](http://stack.com)\lincohn' Feb 16 17:15:07 slot1/APM notice apd[5515]: 01490005:5: f788i7b0: Following rule 'fallback' from item 'SSO Credential Mapping' to ending 'Allow' Here is the query I use to filter out sessions based on their VIP IP (e.g. here 9.9.9.9): { "fields" : ["session\_id"], "query" : { "term" : { "vip\_ip" : "9.9.9.9" } } }' But so far, I am unable to fetch the session id, which is supposed to be in the same document as the VIP IP, and then use this same session id to go fetch the username 2 log lines further, hence, in another document if you use ES language. ---
**Author:** ![jpry](https://avatars.discourse-cdn.com/v4/letter/j/ecae2f/32.png) [@jpry](https://discuss.elastic.co/u/jpry)\ **Post date:** [February 25, 2016, 11:01am UTC](https://discuss.elastic.co/t/how-to-fetch-a-field-value-in-an-elasticsearch-document-and-then-parse-other-documents-based-on-this-same-value/42690/2 "2016-02-25T11:01:07Z")
Am I asking the impossible? ☹ ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 26, 2016, 11:26pm UTC](https://discuss.elastic.co/t/how-to-fetch-a-field-value-in-an-elasticsearch-document-and-then-parse-other-documents-based-on-this-same-value/42690/3 "2016-02-26T23:26:26Z")
This seems to be like a join, which ES cannot do. ---
**Author:** ![jpry](https://avatars.discourse-cdn.com/v4/letter/j/ecae2f/32.png) [@jpry](https://discuss.elastic.co/u/jpry)\ **Post date:** [February 29, 2016, 10:06am UTC](https://discuss.elastic.co/t/how-to-fetch-a-field-value-in-an-elasticsearch-document-and-then-parse-other-documents-based-on-this-same-value/42690/4 "2016-02-29T10:06:03Z")
Thanks for your answer warkolm. If so, is there any other way to perform it? like using another language for scripting? ---
**Author:** ![jpry](https://avatars.discourse-cdn.com/v4/letter/j/ecae2f/32.png) [@jpry](https://discuss.elastic.co/u/jpry)\ **Post date:** [February 29, 2016, 11:05am UTC](https://discuss.elastic.co/t/how-to-fetch-a-field-value-in-an-elasticsearch-document-and-then-parse-other-documents-based-on-this-same-value/42690/5 "2016-02-29T11:05:25Z")
Isn't the sky the limit as to what kind of data one can extract from ES clusters? Isn't it possible to store the value of session\_id like one would do in a normal script, and then use it further to parse once again all ES documents containing these session IDs looking for corresponding user IDs ? The whole thing only with DSL Queries and aggs? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 29, 2016, 9:20pm UTC](https://discuss.elastic.co/t/how-to-fetch-a-field-value-in-an-elasticsearch-document-and-then-parse-other-documents-based-on-this-same-value/42690/6 "2016-02-29T21:20:24Z")
You can do this, but you need to do it in multiple queries and then join the data external to ES. ---
**Author:** ![jpry](https://avatars.discourse-cdn.com/v4/letter/j/ecae2f/32.png) [@jpry](https://discuss.elastic.co/u/jpry)\ **Post date:** [March 1, 2016, 9:45am UTC](https://discuss.elastic.co/t/how-to-fetch-a-field-value-in-an-elasticsearch-document-and-then-parse-other-documents-based-on-this-same-value/42690/7 "2016-03-01T09:45:07Z")
Even so , I guess it is impossible to integrate all this into kibana...? ---
**Author:** ![jpry](https://avatars.discourse-cdn.com/v4/letter/j/ecae2f/32.png) [@jpry](https://discuss.elastic.co/u/jpry)\ **Post date:** [March 1, 2016, 2:05pm UTC](https://discuss.elastic.co/t/how-to-fetch-a-field-value-in-an-elasticsearch-document-and-then-parse-other-documents-based-on-this-same-value/42690/8 "2016-03-01T14:05:31Z")
I maybe found an alternative to this. By using grok filter, there is a way to consolidate multiple lines into a single event, and thus, have all lines related to a particular session id connected: [https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html) That would make the connected lines belong to the same ES document, and therefore make the search with DSL Queries possible. That would be easy to implement if the indicator that proves an event field is part of a multi-line event was known in advance. But what if the indicator is a random session id that cannot be guessed? and the different log events interwined and not consecutive? I don't know yet if it is feasible. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:12pm UTC](https://discuss.elastic.co/t/how-to-fetch-a-field-value-in-an-elasticsearch-document-and-then-parse-other-documents-based-on-this-same-value/42690/9 "2017-07-05T23:12:27Z")