KQL (or SQL or DSL): How to do transaction/pairing up between events based on a same sessiond, user combo?

[kelk (kin)]

We have certain dataset like below

2020-09-10T01:00:01 entry=1 user=A session=ses1 action=create
2020-09-10T01:01:01 entry=2 user=A session=ses1 action=delete
2020-09-10T01:02:01 entry=3 user=B session=ses2 action=create
2020-09-10T01:03:01 entry=4 user=A session=ses3 action=create
2020-09-10T01:04:01 entry=5 user=A session=ses3 action=update

Looking for stitching together these into transactions, if User is SAME and Session is SAME..
So the outcome should be TWO transaction pair like below
Pair1

2020-09-10T01:00:01 entry=1 user=A session=ses1 action=create
2020-09-10T01:01:01 entry=2 user=A session=ses1 action=delete

Pair2

2020-09-10T01:03:01 entry=4 user=A session=ses3 action=create
2020-09-10T01:04:01 entry=5 user=A session=ses3 action=update

How could we achieve this in Elatic? Any language format is good enough

In Splunk etc, there is a command called "transaction" wihch exactly does this. Any similar cmd in Kibana?

[flash1293 (Joe Reuter)]

It depends on what you want to do with the transaction - when working with visualizations (which use aggregations), you can use two nested terms aggregations (for user and session) - this will create one bucket per session which you can use to get metrics (like the number of actions or things like this)

[kelk (kin)]

this is for watcher, so as to to report on number of users who have logged in and have updated/deleted within same session.
Any example would be great for nested terms aggregations to pair such events

[Hendrik_Muhs]

You might want to look at transform, it's useful to create sessions out of events. The result is written to an index, so you can create a watcher for it.

It all depends on what type of analyzes you aim for. If you only have simple requirements like give me the session length for user X, a runtime query will work.

But if you need 2nd order analyzes like average session length over all users in the last month, you need something like transform to store the result of the session creation, so you can query on this.

To dive into this topic I can also recommend this webinar recording.