Search/Query with OR over separate lines for same ID

Elastic Stack Kibana
1

Hi,

I have have data structured in the example of the table below ("-" = null):

transaction-id field-1 field-2
trans-1 44 -
trans-1 - 12
trans-1 - 5
trans-2 10 -
trans-3 - 20
trans-4 - -

I would like to filter/query in my searches/discover/visualization for all transaction-ids that have a value in field-1 AND in field-2 when looking/aggregating at the unique transaction-id.
So in this case the expected result from the search query would be all 3 trans-1 entries.

How can I achieve this in Kibana?

If I do KQL:
NOT field-1 : null or NOT field-2 : null
I get trans-1, trans-2, trans-3 in my results

If I do KQL:
NOT field-1 : null and NOT field-2 : null
I get no results at all

Thanks in advance for your help!

2

I would do FIELD1:* AND FIELD2:* —> this means return all documents where both field 1 and field 2 contains any value

3

Hi,
thank you for you answer.
Unfortunately this is not the solution I am looking for.
This Search still shows trans-1, trans-2, trans-3 and not just the trans-1 lines.

4

I think in your document “-“ is actually the litteral value of the field so when you search for field1:* AND field2:* it would still include fields with “-“ so I would try (field1:* AND field2:*) AND NOT (field1:”-“ OR field2:”-“) this would give you all records with values in field1 and field2 and not the “-“ value. I am still confused about your use of transaction_id field so if this query I proposed isnt what you are looking for, can you clarify your final goal with query?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.