# Kibana Search Query

**URL:** <https://discuss.elastic.co/t/kibana-search-query/236528>\
**Category:** Kibana\
**Created:** [June 10, 2020, 3:04pm UTC](https://discuss.elastic.co/t/kibana-search-query/236528 "2020-06-10T15:04:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![santos1204](https://avatars.discourse-cdn.com/v4/letter/s/b3f665/32.png) [@santos1204](https://discuss.elastic.co/u/santos1204)\
**Post date:** [June 10, 2020, 3:04pm UTC](https://discuss.elastic.co/t/kibana-search-query/236528/1 "2020-06-10T15:04:52Z")

</div>

Hi,

I'm trailing ELK at the moment within the insurance space, have an issue and wondering if Kibana can solve it. Our software creates two messages that identify the start and finish of a quotation that I'm easily able to identify within Kibana.

I'm were wondering if it’s possible, on receipt of the “finish” message for Elastic to search back for the most recent “start” message for the same user and to visualise this as a time period on a graph/and send this information to a 3rd party software.

Many thanks,

Chris

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [June 11, 2020, 7:33pm UTC](https://discuss.elastic.co/t/kibana-search-query/236528/2 "2020-06-11T19:33:32Z")

</div>

Kibana can not do this, but you can do this in the Elastic stack with the [enrichment processor](https://www.elastic.co/guide/en/elasticsearch/reference/7.x/ingest-enriching-data.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2020, 7:33pm UTC](https://discuss.elastic.co/t/kibana-search-query/236528/3 "2020-07-09T19:33:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
