How to find events with duplicate field value?

Elastic Stack Kibana
1

Hi,

I have events which contains a numeric field action.id.
When I filter action.id to be present for these events and aggregate for count and unique count I get different values.

I understand it this way, that one or some action.ids have a count of more than one.
Currently I am talking about 100,000 messages.

I need to retrieve all events, where the action.id occurs in more than one event.
How do I do this?

Can I do it in kibana?

2

You should be able to do so with count but you may have to set the JSON input to { “min_doc_count”: 2 } in order to show values higher than 1. See example here Retrieve duplicate data using Kibana search bar.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.