# How to use group clause in search query? **URL:** \ **Category:** Kibana\ **Created:** [September 7, 2016, 9:23pm UTC](https://discuss.elastic.co/t/how-to-use-group-clause-in-search-query/60019 "2016-09-07T21:23:13Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [September 7, 2016, 9:23pm UTC](https://discuss.elastic.co/t/how-to-use-group-clause-in-search-query/60019/1 "2016-09-07T21:23:13Z")
![](https://us1.discourse-cdn.com/elastic/original/2X/c/c75d8587acdf6a9f56bcdad87506f15b95023c6f.png) I am trying to search for a record which has Internal Server Error, the match URL, and session ID. Is there a way that I can get only session ID's that are matching ? ---
**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\ **Post date:** [September 8, 2016, 9:57pm UTC](https://discuss.elastic.co/t/how-to-use-group-clause-in-search-query/60019/2 "2016-09-08T21:57:58Z")
In the filter box you can specify the field you want to match, like: ```auto Payload_reasonPhrase:"Internal Server Error" Payload_sessionID:"XYZ" ``` Does that help? ---
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [September 9, 2016, 10:39pm UTC](https://discuss.elastic.co/t/how-to-use-group-clause-in-search-query/60019/3 "2016-09-09T22:39:15Z")
The actual use case here is to the particular URL with Internal Server Errors only. Searching for GUIDs from many records wont be that easy. Since, both the URL and Reason Phrase are logged as 2 different events. If I have the GUID, then its easy. Any other suggestion ? ---
**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\ **Post date:** [September 9, 2016, 11:01pm UTC](https://discuss.elastic.co/t/how-to-use-group-clause-in-search-query/60019/4 "2016-09-09T23:01:22Z")
I'm afraid that the best way to do that would be to change the way you are storing these events. If the reasonPhrase and requestUri are related to the same event then they should be in the same document in elasticsearch. Elasticsearch isn't relational, so joining on something like sessionID isn't going to work out of the box. I'm pretty sure that there are some tricks you can use to do it, but Kibana doesn't support it out of the box so I don't recommend it. ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [November 10, 2016, 12:20am UTC](https://discuss.elastic.co/t/how-to-use-group-clause-in-search-query/60019/5 "2016-11-10T00:20:00Z")
Reviving an old thread, but I stumbled across this while looking for something else and I had a thought. What if, using the Visualize app, you do a terms agg on the sessionID field along with the query you have here? Any bucket with a doc count of 2 should be a culprit. If there's a potential for multiple "Internal Server Error" or "URL" documents for a given ID over time, you could also add a date histogram agg with a fairly small interval to hopefully narrow it down to one error per bucket (I'm assuming the url doc and the error doc will have matching timestamps, or at least be within milliseconds of each other, whereas separate errors are probably minutes, hours, or days apart). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:34pm UTC](https://discuss.elastic.co/t/how-to-use-group-clause-in-search-query/60019/6 "2017-07-06T13:34:15Z")
Closed on July 6, 2017, 1:34pm UTC