# How to get all orders without specific status in kibana or elastic search

**URL:** https://discuss.elastic.co/t/how-to-get-all-orders-without-specific-status-in-kibana-or-elastic-search/255152
**Category:** Kibana
**Tags:** painless
**Created:** [November 12, 2020, 6:25am UTC](https://discuss.elastic.co/t/how-to-get-all-orders-without-specific-status-in-kibana-or-elastic-search/255152 "2020-11-12T06:25:21Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![name\_11111](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/name_11111/32/78877_2.png) [@name\_11111](https://discuss.elastic.co/u/name_11111)
#### Post date: [November 12, 2020, 6:25am UTC](https://discuss.elastic.co/t/how-to-get-all-orders-without-specific-status-in-kibana-or-elastic-search/255152/1 "2020-11-12T06:25:21Z")

</div>

I have a table such type in kibana

* * *

|id| timestamp|status |

* * *

|1 |time |created|

* * *

|1| time |closed |

* * *

|2 |time |created|

How i can get all id which doesnt have status "closed" and they where created older 20 days

---

<div class="post-metadata">

### Author: ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)
#### Post date: [November 12, 2020, 8:33am UTC](https://discuss.elastic.co/t/how-to-get-all-orders-without-specific-status-in-kibana-or-elastic-search/255152/2 "2020-11-12T08:33:35Z")

</div>

Hey, it seems like your data is event based (one document per change of a status), but the question you want to answer is entity based (give all ids which have a certain combination of events).

To do this, the best option is to transform your event based index to an entity based index using transforms: [https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-overview.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-overview.html)

It allows you to create one document per id which you can use to store the first timestamp and the count of "closed" status updates.

You can set up transforms to run continuously on incoming data, maintaining to "views" on your data (event based and entity based, whenever it makes sense)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 10, 2020, 8:33am UTC](https://discuss.elastic.co/t/how-to-get-all-orders-without-specific-status-in-kibana-or-elastic-search/255152/3 "2020-12-10T08:33:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.