Search items in several `steps`

Elastic Stack Elasticsearch
1

Hello everyone,

I'm a new to ElasticSearch and can have a really stupid questions, but anyway during last several hours I'm unable to find a solution for my relatively typical situation:

Let's say I have logs from a backend application with difference types of user-events: Registration, New Connections, other actions.

Using Logstash I push all this data to ElasticSearch and want to make a filter to find user actions by registration parameters.

How can I make a nested (I can't tell that this is the right word for it) filters?

Exampe:

  1. I want to find userIDs by specific Location (GeoIP) of Registration.
  2. And then I want to see user actions lines filtered using these userIDs and action type (let's say Logout).

Thanks,
Andrey

2

You can't do that as it's like a join in an RDBMS.

You'd need to do two separate queries.

3

Thanks for your answer! So is there any way to connect those? Or I need to do a manual copy paste into another queue?

4

It's be external to ES, so in your code.

1 Like