Retrieving a chain of related records


We're considering Elasticsearch as a log aggregation/log analysis platform. Our software comprises of multiple services running micro-processes generating related log records which look much like this:

12:00:01 MODULE-1 ID-1 Spawned by external event EVENTTYPE-ID-0
12:00:01 MODULE-1 ID-1 Spawns new module-2
12:00:01 MODULE-2 ID-2 Spawned by MODULE-1-ID-1
12:00:01 MODULE-2 ID-2 Spawns new module-3
12:00:01 MODULE-3 ID-3 Spawned by MODULE-2-ID-2

What would be the most efficient way to store and retrieve all the records from all the micro-processes serving the initial event ID-0? The reference to a document describing solution for a similar problem would be most appreciated (I failed to find one, but as a non-native speaker I might have missed proper keywords)

Thank you!