# Kibana query help, find entries that occur on two different sites

**URL:** <https://discuss.elastic.co/t/kibana-query-help-find-entries-that-occur-on-two-different-sites/245790>\
**Category:** Kibana\
**Created:** [August 20, 2020, 3:33pm UTC](https://discuss.elastic.co/t/kibana-query-help-find-entries-that-occur-on-two-different-sites/245790 "2020-08-20T15:33:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![stcdarrell](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\
**Post date:** [August 20, 2020, 3:33pm UTC](https://discuss.elastic.co/t/kibana-query-help-find-entries-that-occur-on-two-different-sites/245790/1 "2020-08-20T15:33:45Z")

</div>

hi, i'm struggling to sort out how to get a query to work.

I have two sites sending logs via filebeat into an ELK stack.  
Each entry will have a field called "site" along with a bunch of log info (ip address, port, etc)

what i'd like to do is have a query that shows ip addresses that appear at both sites, and how many times they hit the sites.  
Example:  
IP: 192.168.1.134  
Port: 53  
Site1 Count: 153  
Site2 Count: 27

any suggestions on how i could do this?

---

<div class="post-metadata">

**Author:** ![myasonik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/myasonik/32/62369_2.png) [@myasonik](https://discuss.elastic.co/u/myasonik)\
**Post date:** [August 20, 2020, 7:03pm UTC](https://discuss.elastic.co/t/kibana-query-help-find-entries-that-occur-on-two-different-sites/245790/2 "2020-08-20T19:03:49Z")

</div>

If I'm understanding you correctly, your `site` field is a nested field with a bunch of data inside?

If so, that'll make it hard to work with so I'd recommend splitting it up into individual fields.

If the formatting of your example is important to you, probably the best way to do it would be a markdown visualization which I think you can only [create within Canvas](https://www.elastic.co/blog/kibana-canvas-metric-and-markdown-elements). Otherwise, you can create a couple of metric visualizations for each count you're looking for.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 17, 2020, 7:04pm UTC](https://discuss.elastic.co/t/kibana-query-help-find-entries-that-occur-on-two-different-sites/245790/3 "2020-09-17T19:04:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.