Make a search using a fields values resulting from a search


(Tony Amirault) #1

Hello everyone,

It's possible to : Make a search using a fields values resulting from a search.

Example :

1 - I make a search on "FINALIZED" and my result is :

ID : 007 ; MESSAGE : "FINALIZED"
ID : 002 ; MESSAGE : "FINALIZED"
ID : 001 ; MESSAGE : "FINALIZED"

2 - after, i use every value on the field ID to make a new search (here is the point), example :
ID:007 AND ID:002 AND ID:001 AND MESSAGE:"NEW PROJECT"

3 - Then i have the number of ID with "NEW PROJECT" AND "FINALIZED". :slight_smile:

Thank you in advance !

Best regard,

Tony


(Tim Sullivan) #2

I think what you are asking isn't really possible or practical to do in Kibana through our visualization editors. What people usually want to do is allow their own data to "do" this work through an expressive data model.

For example, if you had document types in your data that gave a representation of the "projects" or entities that had the NEW PROJECT attribute as well as the FINALIZED attribute, then you could make get a count of how many of those documents exist. If I were to do that, I would filter for those types of documents with a query like: is_new:true AND is_finalized:true

That could be done in a new "meta" document type that gets created whenever a project meets all that criteria, or you could do an update on an existing project document once is passes through each one of those criteria stages. I think I would go for the latter, for simplicity.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.