# Kibana - list an event which is happened after another event based on time stamp

**URL:** https://discuss.elastic.co/t/kibana-list-an-event-which-is-happened-after-another-event-based-on-time-stamp/102602
**Category:** Kibana
**Created:** [October 3, 2017, 7:00pm UTC](https://discuss.elastic.co/t/kibana-list-an-event-which-is-happened-after-another-event-based-on-time-stamp/102602 "2017-10-03T19:00:50Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Faisal\_Karakunnel\_Mo](https://avatars.discourse-cdn.com/v4/letter/f/a8b319/32.png) [@Faisal\_Karakunnel\_Mo](https://discuss.elastic.co/u/Faisal_Karakunnel_Mo)
#### Post date: [October 3, 2017, 7:00pm UTC](https://discuss.elastic.co/t/kibana-list-an-event-which-is-happened-after-another-event-based-on-time-stamp/102602/1 "2017-10-03T19:00:50Z")

</div>

Hi,

I am a new to Kibana and my main use is for even analysis reported from different components. My question is on the usage level.

Assume that all the entries has time stamps and a field which represents some events. lets say the events are A,B, C and D. I would like to list down all the C events which happens immediately after D.

Any idea this kind of usage is possible?

thanks  
Faisal

---

<div class="post-metadata">

### Author: ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)
#### Post date: [October 4, 2017, 10:07am UTC](https://discuss.elastic.co/t/kibana-list-an-event-which-is-happened-after-another-event-based-on-time-stamp/102602/2 "2017-10-04T10:07:27Z")

</div>

@Faisal_Karakunnel_Mo

From my understanding , I dont think there is a query that corelates each event while searching.  
Thus you would want to add a tag or a field to represent that **C event** consecutively came after **D event**.

How about using [aggregation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate) plugin to corelate the events with logstash before indexing?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 4, 2017, 10:10am UTC](https://discuss.elastic.co/t/kibana-list-an-event-which-is-happened-after-another-event-based-on-time-stamp/102602/3 "2017-10-04T10:10:43Z")

</div>

Have a look at [this thread](https://discuss.elastic.co/t/elasticsearch-sequence-pattern-mining/88255), which discusses a similar problem.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 1, 2017, 10:11am UTC](https://discuss.elastic.co/t/kibana-list-an-event-which-is-happened-after-another-event-based-on-time-stamp/102602/4 "2017-11-01T10:11:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
