# Query like UNION. Is it possible?

**URL:** <https://discuss.elastic.co/t/query-like-union-is-it-possible/65335>\
**Category:** Kibana\
**Created:** [November 8, 2016, 10:31am UTC](https://discuss.elastic.co/t/query-like-union-is-it-possible/65335 "2016-11-08T10:31:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lego](https://avatars.discourse-cdn.com/v4/letter/l/b5e925/32.png) [@Lego](https://discuss.elastic.co/u/Lego)\
**Post date:** [November 8, 2016, 10:31am UTC](https://discuss.elastic.co/t/query-like-union-is-it-possible/65335/1 "2016-11-08T10:31:27Z")

</div>

Hello.

Maybe I want to get strange thing but I'd like to do it.

I've got log files which contain following data:

ReportName, ReportAction (with values ReportStarted or ReportFinished. Each log can contain only one value: ReportFinished or ReportStarted) and UID. UID is unique for each report. I mean that we can have two strings with one UID in case that report has been finished or we can have only one string with UID in case if report has been chancelled.

The text above can be shown in table form. For example table1 and table2:

# table1 ReportName |ReportAction | UID |

Report1 |Started |u\_11111 |  
Report2 |Started |u\_22222 |  
Report3 |Started |u\_33333 |

# table2 ReportName |ReportAction | UID |

Report1 |Finished |u\_11111 |  
Report2 |Finished |u\_22222 |

My quiestion. Is it possible to write query looks like UNION statement in SQL?

SELECT ReportName, UID  
FROM table1

UNION

SELECT ReportName, UID  
FROM table2

According to tables above I can say that I'd like to get as final result only string report3, showing report which has been started but hasn't been completed (chancelled for example).

---

<div class="post-metadata">

**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\
**Post date:** [November 8, 2016, 10:13pm UTC](https://discuss.elastic.co/t/query-like-union-is-it-possible/65335/2 "2016-11-08T22:13:34Z")

</div>

There isn't any way to do unions with Elasticsearch documents. Instead, would it be possible for you to have a single document for each report, with `started` and `finished` fields? When a report starts, you could index a document with the `started` time. When the report finishes, you could simply update the existing document with the `finished` time. This seems like it would make what you're trying to do much simpler.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 6, 2016, 10:13pm UTC](https://discuss.elastic.co/t/query-like-union-is-it-possible/65335/3 "2016-12-06T22:13:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.