# Kibana Query Question

**URL:** https://discuss.elastic.co/t/kibana-query-question/285997
**Category:** Kibana
**Tags:** kql-kibana-query-language
**Created:** [October 6, 2021, 9:00am UTC](https://discuss.elastic.co/t/kibana-query-question/285997 "2021-10-06T09:00:27Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![vladik22](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vladik22/32/78720_2.png) [@vladik22](https://discuss.elastic.co/u/vladik22)
#### Post date: [October 6, 2021, 9:00am UTC](https://discuss.elastic.co/t/kibana-query-question/285997/1 "2021-10-06T09:00:27Z")

</div>

Hello guys  
Is it possible and how can I to filter documents from one index according to values from another index?  
For example I have 2 indexes Logs and Activities

 ![ELK](https://us1.discourse-cdn.com/elastic/original/3X/3/3/33c37814d76c2b88e1205af2c930e729aa9c35ef.png)  
I want to see in visualisation documents from index Logs only for specific ID.  
For example ID 1111 have 2 log files(file1.log, file3.log). I want to display documents from index Logs where Logfile==(File from index Activities where ID==1111).  
Is it posible to do it?  
Thanks in advance!

---

<div class="post-metadata">

### Author: ![vladik22](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vladik22/32/78720_2.png) [@vladik22](https://discuss.elastic.co/u/vladik22)
#### Post date: [October 10, 2021, 9:13am UTC](https://discuss.elastic.co/t/kibana-query-question/285997/2 "2021-10-10T09:13:01Z")

</div>

I have query on SQL:

```auto
SELECT * FROM [Logs]
JOIN Activities ON Activities.ID= "1111" and Activities.File = Logs.Logfile;

```

I need something similar on KQL. Somebody can help me?

---

<div class="post-metadata">

### Author: ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [October 10, 2021, 10:53am UTC](https://discuss.elastic.co/t/kibana-query-question/285997/3 "2021-10-10T10:53:17Z")

</div>

Don't think that is possible using KQL. I'd suggest making a [transform](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html) that will do that transformation from 2 indexes into 1 and then you query from that 1.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 11, 2021, 4:26am UTC](https://discuss.elastic.co/t/kibana-query-question/285997/4 "2021-10-11T04:26:30Z")

</div>

Correct, you cannot do that without "joining" both indices into one.

---

<div class="post-metadata">

### Author: ![vladik22](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vladik22/32/78720_2.png) [@vladik22](https://discuss.elastic.co/u/vladik22)
#### Post date: [October 13, 2021, 2:09pm UTC](https://discuss.elastic.co/t/kibana-query-question/285997/5 "2021-10-13T14:09:32Z")

</div>

Thank you. I don't see option how to transform 2 indexes into 1. I see in documentation that transform don't intended for that.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 10, 2021, 2:09pm UTC](https://discuss.elastic.co/t/kibana-query-question/285997/6 "2021-11-10T14:09:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.