# Match Logs Without a Common ID **URL:** \ **Category:** Logstash\ **Created:** [October 28, 2015, 5:48pm UTC](https://discuss.elastic.co/t/match-logs-without-a-common-id/33174 "2015-10-28T17:48:42Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![chelseac313](https://avatars.discourse-cdn.com/v4/letter/c/cc9497/32.png) [@chelseac313](https://discuss.elastic.co/u/chelseac313)\ **Post date:** [October 28, 2015, 5:48pm UTC](https://discuss.elastic.co/t/match-logs-without-a-common-id/33174/1 "2015-10-28T17:48:42Z")
I am trying to match logs that do not have a common id between them. I'm trying to match a log that has the state ALARM with a log that is identical except the state is NORMAL. I am able to use grok to take apart my messages and get those states along with other identifying factors. However, there are usually many logs between a corresponding ALARM and NORMAL log and those logs in between may have their own ALARM and NORMAL states. I have been unable to find a similar approach to accomplish what I'm looking for. The end result is to have an event that has a start and end time (ALARM log time and NORMAL log time). If I can provide other information that would be useful, please let me know. What steps should be taken to achieve this sort of matching or where should I be looking for more information? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:25am UTC](https://discuss.elastic.co/t/match-logs-without-a-common-id/33174/2 "2017-07-06T05:25:01Z")
Closed on July 6, 2017, 5:25am UTC