# Search list of errors present in a table and aggregate that from another table **URL:** \ **Category:** Elasticsearch\ **Created:** [April 28, 2017, 4:54am UTC](https://discuss.elastic.co/t/search-list-of-errors-present-in-a-table-and-aggregate-that-from-another-table/83965 "2017-04-28T04:54:48Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Ravi\_Shanker\_Reddy](https://avatars.discourse-cdn.com/v4/letter/r/a5b964/32.png) [@Ravi\_Shanker\_Reddy](https://discuss.elastic.co/u/Ravi_Shanker_Reddy)\ **Post date:** [April 28, 2017, 4:54am UTC](https://discuss.elastic.co/t/search-list-of-errors-present-in-a-table-and-aggregate-that-from-another-table/83965/1 "2017-04-28T04:54:48Z")
I have a index named `errors` and different types like `network, system, user` etc.. I have another index which is maintaining all the days data `EX: smsc-2017.03.23` Can I able to get all `system errors` from the `smsc-2017.03.23` within a hour interval along with its count??? Or any other way to read the errors from falt file and search??? Any suggestions are great. Thanks ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 28, 2017, 8:02am UTC](https://discuss.elastic.co/t/search-list-of-errors-present-in-a-table-and-aggregate-that-from-another-table/83965/2 "2017-04-28T08:02:19Z")
> [@Ravi\_Shanker\_Reddy](#): > > Can I able to get all system errors from the smsc-2017.03.23 within a hour interval along with its count??? Sure, just run a date aggregation with a filter for errors - [Date Histogram Aggregation | Elasticsearch Guide [5.3] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/5.3/search-aggregations-bucket-datehistogram-aggregation.html) > [@Ravi\_Shanker\_Reddy](#): > > Or any other way to read the errors from falt file and search??? Load them with Logstash? ---
**Author:** ![Ravi\_Shanker\_Reddy](https://avatars.discourse-cdn.com/v4/letter/r/a5b964/32.png) [@Ravi\_Shanker\_Reddy](https://discuss.elastic.co/u/Ravi_Shanker_Reddy)\ **Post date:** [April 28, 2017, 9:52am UTC](https://discuss.elastic.co/t/search-list-of-errors-present-in-a-table-and-aggregate-that-from-another-table/83965/3 "2017-04-28T09:52:16Z")
> [@warkolm](#): > > Sure, just run a date aggregation with a filter for errors @warkolm You are misunderstanding. If you are aggregating you will get all errors. But I need only network errors. > [@Ravi\_Shanker\_Reddy](#): > > I have a index named `errors` and in that index different types(tables) like `network`, `system`, `user` etc.. Get all the errors and filter the network errors which are saved in the another type(table). ``` mysql> select * from error_list; +--------------------------------------------+---------------+ | name | type | +--------------------------------------------+---------------+ | SMSC_TM_IM_unspecified_error_cause | network_error | | SMSC_TM_IM_Unspecified_command_error | network_error | | SMSC_TM_IM_Command_cannot_be_actioned | network_error | | SMSC_PR_LC_LOCAL_ERROR_MAX_LENGTH_EXCEEDED | system_error | +--------------------------------------------+---------------+ mysql> select * from user_data; +------+--------------------------------------------+--------------+ | name | error | callednumber | +------+--------------------------------------------+--------------+ | SMSC | SMSC_PR_LC_LOCAL_ERROR_MAX_LENGTH_EXCEEDED | 919716099155 | | SMSC | SMSC_TM_IM_Unspecified_command_error | 919716099155 | | SMSC | SMSC_TM_IM_unspecified_error_cause | 919716099155 | | SMSC | SMSC_TM_IM_unspecified_error_cause | 919716099155 | | SMSC | SMSC_TM_IM_unspecified_error_cause | 919716099155 | | SMSC | SMSC_TM_IM_unspecified_error_cause | 919716099155 | | SMSC | SMSC_TM_IM_unspecified_error_cause | 919716099155 | | SMSC | SMSC_TM_IM_unspecified_error_cause | 919716099155 | | SMSC | SMSC_TM_IM_unspecified_error_cause | 919716099155 | | SMSC | SMSC_TM_IM_unspecified_error_cause | 919716099155 | | SMSC | SMSC_TM_IM_Command_cannot_be_actioned | 919716099155 | | SMSC | SMSC_PR_LC_LOCAL_ERROR_MAX_LENGTH_EXCEEDED | 919716099155 | | SMSC | SMSC_PR_LC_LOCAL_ERROR_MAX_LENGTH_EXCEEDED | 919716099155 | | SMSC | SMSC_PR_LC_LOCAL_ERROR_MAX_LENGTH_EXCEEDED | 919716099155 | +------+--------------------------------------------+--------------+ ``` `mysql> select err.name,count(user.error) as error_count from error_list err join user_data user on err.name=user.error where err.type="network_error" group by err.name;` I need similar query in elasticsearch. ---
**Author:** ![Ravi\_Shanker\_Reddy](https://avatars.discourse-cdn.com/v4/letter/r/a5b964/32.png) [@Ravi\_Shanker\_Reddy](https://discuss.elastic.co/u/Ravi_Shanker_Reddy)\ **Post date:** [April 28, 2017, 1:42pm UTC](https://discuss.elastic.co/t/search-list-of-errors-present-in-a-table-and-aggregate-that-from-another-table/83965/4 "2017-04-28T13:42:33Z")
[https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-terms-query.html#\_terms\_lookup\_twitter\_example](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-terms-query.html#_terms_lookup_twitter_example) Solved like this ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 26, 2017, 1:43pm UTC](https://discuss.elastic.co/t/search-list-of-errors-present-in-a-table-and-aggregate-that-from-another-table/83965/5 "2017-05-26T13:43:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.