# Merging Kibana Results
**URL:** https://discuss.elastic.co/t/merging-kibana-results/345770
**Category:** Kibana
**Created:** [October 26, 2023, 4:08am UTC](https://discuss.elastic.co/t/merging-kibana-results/345770 "2023-10-26T04:08:13Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@vamc](https://discuss.elastic.co/u/vamc)
#### Post date: [October 26, 2023, 4:08am UTC](https://discuss.elastic.co/t/merging-kibana-results/345770/1 "2023-10-26T04:08:13Z")
I have two logs from two different applications writing to the same index.
Log1:
```auto
[
"Processed Payload - UID: c9c9502f-f398-434f-3d2efc7853a3, AlertId : 000130114"]
```
Log2:
```auto
["Processed Payload - UID: c9c9502f-f398-434f-3d2efc7853a3, ClientId: 283400, TrackId: tracking-456, File: transaction.csv"]
```
From the UID in log2 i need to check if there are any matching alertId in log1 and if found i need to merge the data and get it in the below format.
```auto
Processed Payload - UID: c9c9502f-f398-434f-3d2efc7853a3, ClientId: 283400, TrackId: tracking-456, File: transaction.csv", AlertId:000130114
```
How can i do this ??
I will need this to be running as part of Kibana watcher
---
### Author:  [@jsanz](https://discuss.elastic.co/u/jsanz)
#### Post date: [October 27, 2023, 12:41pm UTC](https://discuss.elastic.co/t/merging-kibana-results/345770/2 "2023-10-27T12:41:35Z")
As you may know, Elasticsearch is not meant to run JOIN queries at runtime.
I think I would approach this as:
- Process your incoming data to extract the identifiers using an [ingest pipeline](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html), maybe even using the [reroute processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/reroute-processor.html) to split your logs in different indices.
- Create a [pivot transform](https://www.elastic.co/guide/en/elasticsearch/reference/8.10/transform-overview.html#pivot-transform-overview) that pivots (merges) the entries with a common `UID`. You can probably even set up another ingest pipeline in the new output index to generate that format message but you probably want to do that later.
I'm unsure how this plays with your Kibana Watcher use case, but it seems worth exploring.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 24, 2023, 12:41pm UTC](https://discuss.elastic.co/t/merging-kibana-results/345770/3 "2023-11-24T12:41:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.