Hi, Would like to know if there is a way to write a query that finds out for which all request events, the corresponding response event was missing. For e.g. In case of below data: PUT test-index/test/_bulk?refresh {"index":{"_id":1}} {"msg_type":"request","msg_id":"abc","message":"Hello"} {"…

Query to find requests that don't have a matching response

Mark_Harwood (Mark Harwood) February 12, 2018, 9:20am 2

This question looks like another case of "joining related records based on a high cardinality ID"
See How to search relationship between log lines

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.