# Retrieving a chain of related records

**URL:** https://discuss.elastic.co/t/retrieving-a-chain-of-related-records/48297
**Category:** Elasticsearch
**Created:** [April 25, 2016, 9:57am UTC](https://discuss.elastic.co/t/retrieving-a-chain-of-related-records/48297 "2016-04-25T09:57:41Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![anaidyonov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anaidyonov/32/9389_2.png) [@anaidyonov](https://discuss.elastic.co/u/anaidyonov)
#### Post date: [April 25, 2016, 9:57am UTC](https://discuss.elastic.co/t/retrieving-a-chain-of-related-records/48297/1 "2016-04-25T09:57:41Z")

</div>

Hello;

We're considering Elasticsearch as a log aggregation/log analysis platform. Our software comprises of multiple services running micro-processes generating related log records which look much like this:

12:00:01 MODULE-1 ID-1 Spawned by external event EVENTTYPE-ID-0  
12:00:01 MODULE-1 ID-1 Spawns new module-2  
12:00:01 MODULE-2 ID-2 Spawned by MODULE-1-ID-1  
12:00:01 MODULE-2 ID-2 Spawns new module-3  
12:00:01 MODULE-3 ID-3 Spawned by MODULE-2-ID-2  
...

What would be the most efficient way to store and retrieve all the records from all the micro-processes serving the initial event ID-0? The reference to a document describing solution for a similar problem would be most appreciated (I failed to find one, but as a non-native speaker I might have missed proper keywords)

Thank you!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 10:56pm UTC](https://discuss.elastic.co/t/retrieving-a-chain-of-related-records/48297/2 "2017-07-05T22:56:30Z")

</div>


