# Kibana advanced queries **URL:** \ **Category:** Elasticsearch\ **Created:** [December 4, 2013, 9:36am UTC](https://discuss.elastic.co/t/kibana-advanced-queries/14697 "2013-12-04T09:36:55Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Risto\_Vaarandi](https://avatars.discourse-cdn.com/v4/letter/r/34f0e0/32.png) [@Risto\_Vaarandi](https://discuss.elastic.co/u/Risto_Vaarandi)\ **Post date:** [December 4, 2013, 9:36am UTC](https://discuss.elastic.co/t/kibana-advanced-queries/14697/1 "2013-12-04T09:36:55Z")
hi all, I've been using Kibana for some time now and have come to an issue related to advanced queries. Would it be possible to run a query, take all resulting terms for some field, and use these terms as values for running another query? For example, one could run a query for events which have the 'ipaddr' field, take all terms (IP addresses) for the 'ipaddr' field, and use these IP addresses for running another query (e.g. return events for which the 'host' field is one of the previously detected IP addresses). After having a look into the Kibana web interface, it seems that 'derivequeries' panel would allow to partly address this problem -- after running a query, you can get top N terms for some field F, and then run another N queries with identified terms for the field F. However, this approach has the restriction that the field F has to be the same across all queries. Would it be possible to use another field name F2 for derived queries, and run a single query for checking if F2 has a value that belongs to some set? (For example, something like F2 in (ip1, ip2, ip3)?) kind regards, risto -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/bb1676eb-7cba-41bd-b982-a5ea96c988f8%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/bb1676eb-7cba-41bd-b982-a5ea96c988f8%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Boaz\_Leskes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boaz_leskes/32/723_2.png) [@Boaz\_Leskes](https://discuss.elastic.co/u/Boaz_Leskes)\ **Post date:** [December 4, 2013, 12:06pm UTC](https://discuss.elastic.co/t/kibana-advanced-queries/14697/2 "2013-12-04T12:06:10Z")
Hi Risto, At the moment you can only use the terms discovered from field F to generate queries that search field F. However, what you ask for makes sense - why not see if there is an existing feature request for it here: [Issues · elastic/kibana · GitHub](https://github.com/elasticsearch/kibana/issues) , or open one if there isn't . Cheers, Boaz On Wednesday, December 4, 2013 10:36:55 AM UTC+1, Risto Vaarandi wrote: > hi all, > I've been using Kibana for some time now and have come to an issue related > to advanced queries. > Would it be possible to run a query, take all resulting terms for some > field, and use these terms as values for running another query? For > example, one could run a query for events which have the 'ipaddr' field, > take all terms (IP addresses) for the 'ipaddr' field, and use these IP > addresses for running another query (e.g. return events for which the > 'host' field is one of the previously detected IP addresses). > > After having a look into the Kibana web interface, it seems that > 'derivequeries' panel would allow to partly address this problem -- after > running a query, you can get top N terms for some field F, and then run > another N queries with identified terms for the field F. However, this > approach has the restriction that the field F has to be the same across all > queries. Would it be possible to use another field name F2 for derived > queries, and run a single query for checking if F2 has a value that belongs > to some set? (For example, something like F2 in (ip1, ip2, ip3)?) > > kind regards, > risto -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/f8e4b3d0-bada-4042-a5a9-e5ba48d3eb1d%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/f8e4b3d0-bada-4042-a5a9-e5ba48d3eb1d%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:03am UTC](https://discuss.elastic.co/t/kibana-advanced-queries/14697/3 "2017-07-06T02:03:22Z")
Closed on July 6, 2017, 2:03am UTC