# Need help with kibana search query

**URL:** <https://discuss.elastic.co/t/need-help-with-kibana-search-query/26719>\
**Category:** Kibana\
**Created:** [August 3, 2015, 12:43pm UTC](https://discuss.elastic.co/t/need-help-with-kibana-search-query/26719 "2015-08-03T12:43:18Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Or\_Cohen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/or_cohen/32/3977_2.png) [@Or\_Cohen](https://discuss.elastic.co/u/Or_Cohen)\
**Post date:** [August 3, 2015, 12:43pm UTC](https://discuss.elastic.co/t/need-help-with-kibana-search-query/26719/1 "2015-08-03T12:43:18Z")

</div>

Hi  
I have data like this:

> {"type":"tag","id":"1234"}  
> {"type":"hit","id":"1234"}  
> {"type":"tag","id":"4444"}  
> {"type":"tag","id":"3333"}  
> {"type":"hit","id":"3333"}  
> {"type":"tag","id":"2222"}  
> {"type":"hit","id":"2222"}  
> {"type":"tag","id":"1111"}  
> {"type":"tag","id":"5555"}  
> {"type":"hit","id":"5555"}  
> {"type":"tag","id":"6666"}  
> {"type":"hit","id":"6666"}

And I need to find all the ids that has type tag but don't have type hit  
I expect the result to be:  
id:1111 and id:4444

Thanks

---

<div class="post-metadata">

**Author:** ![Or\_Cohen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/or_cohen/32/3977_2.png) [@Or\_Cohen](https://discuss.elastic.co/u/Or_Cohen)\
**Post date:** [August 4, 2015, 12:31pm UTC](https://discuss.elastic.co/t/need-help-with-kibana-search-query/26719/2 "2015-08-04T12:31:29Z")

</div>

anyone please....

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 4, 2015, 12:57pm UTC](https://discuss.elastic.co/t/need-help-with-kibana-search-query/26719/3 "2015-08-04T12:57:38Z")

</div>

I do not think this is currently possible in Kibana. One way to get around this potential limitation would be to create an [entity centric index](https://www.elastic.co/elasticon/2015/sf/building-entity-centric-indexes) based on the ID to visualise this information.

---

<div class="post-metadata">

**Author:** ![tarunsapra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tarunsapra/32/3903_2.png) [@tarunsapra](https://discuss.elastic.co/u/tarunsapra)\
**Post date:** [August 4, 2015, 2:12pm UTC](https://discuss.elastic.co/t/need-help-with-kibana-search-query/26719/4 "2015-08-04T14:12:28Z")

</div>

HI,

Did you try using "Filter" option in the bucket, that should do the trick. In the filter option you can specify the field you want and it also supports a NOT (!) operator.

---

<div class="post-metadata">

**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\
**Post date:** [August 5, 2015, 6:35am UTC](https://discuss.elastic.co/t/need-help-with-kibana-search-query/26719/5 "2015-08-05T06:35:17Z")

</div>

[Lucene query syntax](https://lucene.apache.org/core/2_9_4/queryparsersyntax.html) should allow you to apply a filter of the complexity you require:  
`
type:"tag" AND NOT type:"hit"
`

After that - you can run a Terms aggregation on IDs (similar idea with different data):

 ![](https://us1.discourse-cdn.com/elastic/original/2X/2/2bb284a2544685d1096f69451998c142fc7055b8.png)

---

<div class="post-metadata">

**Author:** ![Or\_Cohen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/or_cohen/32/3977_2.png) [@Or\_Cohen](https://discuss.elastic.co/u/Or_Cohen)\
**Post date:** [August 5, 2015, 11:03am UTC](https://discuss.elastic.co/t/need-help-with-kibana-search-query/26719/6 "2015-08-05T11:03:08Z")

</div>

thank for the replay,  
your case is different because you are searching from two different fields  
I need to find the IDs that has just one type, that mean I need to run an aggregation of IDs that has unique type - distinct search.  
that could't be done with Lucene

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:15pm UTC](https://discuss.elastic.co/t/need-help-with-kibana-search-query/26719/7 "2017-07-06T14:15:16Z")

</div>

Closed on July 6, 2017, 2:15pm UTC