# KQL (or SQL or DSL): How to do transaction/pairing up between events based on a same sessiond, user combo?
**URL:** https://discuss.elastic.co/t/kql-or-sql-or-dsl-how-to-do-transaction-pairing-up-between-events-based-on-a-same-sessiond-user-combo/248877
**Category:** Kibana
**Created:** [September 16, 2020, 7:36pm UTC](https://discuss.elastic.co/t/kql-or-sql-or-dsl-how-to-do-transaction-pairing-up-between-events-based-on-a-same-sessiond-user-combo/248877 "2020-09-16T19:36:38Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [September 16, 2020, 7:36pm UTC](https://discuss.elastic.co/t/kql-or-sql-or-dsl-how-to-do-transaction-pairing-up-between-events-based-on-a-same-sessiond-user-combo/248877/1 "2020-09-16T19:36:38Z")
We have certain dataset like below
```auto
2020-09-10T01:00:01 entry=1 user=A session=ses1 action=create
2020-09-10T01:01:01 entry=2 user=A session=ses1 action=delete
2020-09-10T01:02:01 entry=3 user=B session=ses2 action=create
2020-09-10T01:03:01 entry=4 user=A session=ses3 action=create
2020-09-10T01:04:01 entry=5 user=A session=ses3 action=update
```
Looking for stitching together these into transactions, if User is SAME and Session is SAME..
So the outcome should be TWO transaction pair like below
Pair1
```auto
2020-09-10T01:00:01 entry=1 user=A session=ses1 action=create
2020-09-10T01:01:01 entry=2 user=A session=ses1 action=delete
```
Pair2
```auto
2020-09-10T01:03:01 entry=4 user=A session=ses3 action=create
2020-09-10T01:04:01 entry=5 user=A session=ses3 action=update
```
How could we achieve this in Elatic? Any language format is good enough
In Splunk etc, there is a command called "transaction" wihch exactly does this. Any similar cmd in Kibana?
---
### Author:  [@flash1293](https://discuss.elastic.co/u/flash1293)
#### Post date: [September 17, 2020, 7:10am UTC](https://discuss.elastic.co/t/kql-or-sql-or-dsl-how-to-do-transaction-pairing-up-between-events-based-on-a-same-sessiond-user-combo/248877/2 "2020-09-17T07:10:12Z")
It depends on what you want to do with the transaction - when working with visualizations (which use aggregations), you can use two nested terms aggregations (for user and session) - this will create one bucket per session which you can use to get metrics (like the number of actions or things like this)
---
### Author:  [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [September 17, 2020, 7:17am UTC](https://discuss.elastic.co/t/kql-or-sql-or-dsl-how-to-do-transaction-pairing-up-between-events-based-on-a-same-sessiond-user-combo/248877/3 "2020-09-17T07:17:31Z")
this is for watcher, so as to to report on number of users who have logged in and have updated/deleted within same session.
Any example would be great for nested terms aggregations to pair such events
---
### Author:  [@Hendrik\_Muhs](https://discuss.elastic.co/u/Hendrik_Muhs)
#### Post date: [September 17, 2020, 9:40am UTC](https://discuss.elastic.co/t/kql-or-sql-or-dsl-how-to-do-transaction-pairing-up-between-events-based-on-a-same-sessiond-user-combo/248877/4 "2020-09-17T09:40:59Z")
You might want to look at [transform](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html), it's useful to create sessions out of events. The result is written to an index, so you can create a watcher for it.
It all depends on what type of analyzes you aim for. If you only have simple requirements like give me the session length for user X, a runtime query will work.
But if you need 2nd order analyzes like average session length over all users in the last month, you need something like transform to store the result of the session creation, so you can query on this.
To dive into this topic I can also recommend this [webinar recording](https://www.elastic.co/webinars/introducing-data-frame-transforms-for-elastic-machine-learning).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 15, 2020, 9:41am UTC](https://discuss.elastic.co/t/kql-or-sql-or-dsl-how-to-do-transaction-pairing-up-between-events-based-on-a-same-sessiond-user-combo/248877/5 "2020-10-15T09:41:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.