# How to write compound queries on kibana to search multi records of logs

**URL:** <https://discuss.elastic.co/t/how-to-write-compound-queries-on-kibana-to-search-multi-records-of-logs/269812>\
**Category:** Kibana\
**Created:** [April 11, 2021, 2:10pm UTC](https://discuss.elastic.co/t/how-to-write-compound-queries-on-kibana-to-search-multi-records-of-logs/269812 "2021-04-11T14:10:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ShashikanthKomandoor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shashikanthkomandoor/32/46221_2.png) [@ShashikanthKomandoor](https://discuss.elastic.co/u/ShashikanthKomandoor)\
**Post date:** [April 11, 2021, 2:10pm UTC](https://discuss.elastic.co/t/how-to-write-compound-queries-on-kibana-to-search-multi-records-of-logs/269812/1 "2021-04-11T14:10:28Z")

</div>

Hi team,

I am currently sending my MTAs' /var/log/maillog files to a centralized Elastic Stack Log Analyser. I am using Elastic Stack version 7.X.

I have got a requirement to search set of message ids which look like **message-id=\<20210411134224.6E07810002DB5@mydomain** against their delivery status.

This is happening if I take each message-id individually and get its Queue Id in that MTA and check the delivery status against that Queue Id. But this entire process requires 2 queries for each message id.

Is it possible to check the delivery status of the message ids in a given duration of time with one single compound query or any other means?

The requirement for the compound query is in Kibana Discovery, Visualization and Dashboards

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [April 27, 2021, 8:40am UTC](https://discuss.elastic.co/t/how-to-write-compound-queries-on-kibana-to-search-multi-records-of-logs/269812/2 "2021-04-27T08:40:01Z")

</div>

Hi  
This is not possible in a single query in Kibana, but what you could do is using our transform solution, to create a summarized index containing the delivery status of each message id:

> **[Transforming data | Elasticsearch Guide \[7.12\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html)**

Best,  
Matthias

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2021, 8:40am UTC](https://discuss.elastic.co/t/how-to-write-compound-queries-on-kibana-to-search-multi-records-of-logs/269812/3 "2021-05-25T08:40:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.