# How to filter records that have no related record
**URL:** https://discuss.elastic.co/t/how-to-filter-records-that-have-no-related-record/263240
**Category:** Elasticsearch
**Created:** [February 4, 2021, 12:57pm UTC](https://discuss.elastic.co/t/how-to-filter-records-that-have-no-related-record/263240 "2021-02-04T12:57:06Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Henk21](https://discuss.elastic.co/u/Henk21)
#### Post date: [February 4, 2021, 12:57pm UTC](https://discuss.elastic.co/t/how-to-filter-records-that-have-no-related-record/263240/1 "2021-02-04T12:57:06Z")
I am loading a feed (ISE syslog events) in a given index. There are two types of events: _Authentication_ events and _Start_ events. The two are related through some unique _session\_id_.
It may happen that for some _Authentication_ events I never get the corresponding _Start_ event (due to some recovery/retry mechanism upstream).
I would like to filter the _Authentication_ events that have a related _Start_ event. Something I would write in a traditional SQL model as an 'in' clause: `select xxx from yyy where session_id in (select session_id from yyy where ...)`
The two events _Authentication_ and _Start_ may come in any order, and quite close to one another. I had a look at the `join` feature in index mapping, but as far as I can see, it would require that the order between related events be always the same (e.g. parent first - _Authenticate_ event, then child - _Start_ event) so that the parent reference may be looked up and added to enrich the child record. But since I have no control over the order of events and the time elapsed between related events may be too short for ES indexing, I don't think this can fly.
The only solution I have found so far is to control the order of events (and ES indexing) through some batch re-processing of the feeds. Not quite elegant - and with race conditions, on top of it.
Thanks for helping out
---
### Author:  [@Brian\_McGue](https://discuss.elastic.co/u/Brian_McGue)
#### Post date: [February 4, 2021, 6:11pm UTC](https://discuss.elastic.co/t/how-to-filter-records-that-have-no-related-record/263240/2 "2021-02-04T18:11:13Z")
Hi @Henk21,
It looks like you are using [elasticsearch](https://www.elastic.co/elasticsearch/) rather than Enterprise Search (which includes App Search and Workplace Search), right? If so, the [Elastic Stack subforum](https://discuss.elastic.co/c/elastic-stack/) would be a better place to ask this question.
Best,
Brian
---
### Author:  [@Henk21](https://discuss.elastic.co/u/Henk21)
#### Post date: [February 5, 2021, 7:49am UTC](https://discuss.elastic.co/t/how-to-filter-records-that-have-no-related-record/263240/3 "2021-02-05T07:49:34Z")
Changed the topic as suggested. Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 5, 2021, 7:49am UTC](https://discuss.elastic.co/t/how-to-filter-records-that-have-no-related-record/263240/4 "2021-03-05T07:49:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.