# Query to find requests that don't have a matching response

**URL:** https://discuss.elastic.co/t/query-to-find-requests-that-dont-have-a-matching-response/119417
**Category:** Elasticsearch
**Created:** [February 12, 2018, 6:28am UTC](https://discuss.elastic.co/t/query-to-find-requests-that-dont-have-a-matching-response/119417 "2018-02-12T06:28:19Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Nikhil\_Utane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikhil_utane/32/27547_2.png) [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)
#### Post date: [February 12, 2018, 6:28am UTC](https://discuss.elastic.co/t/query-to-find-requests-that-dont-have-a-matching-response/119417/1 "2018-02-12T06:28:19Z")

</div>

Hi,

Would like to know if there is a way to write a query that finds out for which all request events, the corresponding response event was missing.

For e.g. In case of below data:

> PUT test-index/test/\_bulk?refresh  
> {"index":{"\_id":1}}  
> {"msg\_type":"request","msg\_id":"abc","message":"Hello"}
> 
> {"index":{"\_id":2}}  
> {"msg\_type":"response","msg\_id":"abc","message":"World"}
> 
> {"msg\_index":{"\_id":3}}  
> {"msg\_type":"request","msg\_id":"xyz","message":"Missing response"}

I want to be able to say 1st and 2nd message form a request and response pair (based on msg\_id) so all good there. Where as for the 3rd one the response was missing which needs to be highlighted.

One option for me is to generate a missing response event from within logstash but just want to know if there is a query available to achieve the same.

-Thanks  
Nikhil

---

<div class="post-metadata">

### Author: ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)
#### Post date: [February 12, 2018, 9:20am UTC](https://discuss.elastic.co/t/query-to-find-requests-that-dont-have-a-matching-response/119417/2 "2018-02-12T09:20:36Z")

</div>

This question looks like another case of "joining related records based on a high cardinality ID"  
See [How to search relationship between log lines](https://discuss.elastic.co/t/how-to-search-relationship-between-log-lines/119078)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 12, 2018, 9:20am UTC](https://discuss.elastic.co/t/query-to-find-requests-that-dont-have-a-matching-response/119417/3 "2018-03-12T09:20:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.