# Search/Query with OR over separate lines for same ID

**URL:** https://discuss.elastic.co/t/search-query-with-or-over-separate-lines-for-same-id/211922
**Category:** Kibana
**Created:** [December 15, 2019, 7:57pm UTC](https://discuss.elastic.co/t/search-query-with-or-over-separate-lines-for-same-id/211922 "2019-12-15T19:57:17Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![codak7](https://avatars.discourse-cdn.com/v4/letter/c/c68b51/32.png) [@codak7](https://discuss.elastic.co/u/codak7)
#### Post date: [December 15, 2019, 7:57pm UTC](https://discuss.elastic.co/t/search-query-with-or-over-separate-lines-for-same-id/211922/1 "2019-12-15T19:57:17Z")

</div>

Hi,

I have have data structured in the example of the table below ("-" = null):

| transaction-id | field-1 | field-2 |
| --- | --- | --- |
| trans-1 | 44 | - |
| trans-1 | - | 12 |
| trans-1 | - | 5 |
| trans-2 | 10 | - |
| trans-3 | - | 20 |
| trans-4 | - | - |

I would like to filter/query in my searches/discover/visualization for all transaction-ids that have a value in field-1 AND in field-2 when looking/aggregating at the unique transaction-id.  
So in this case the expected result from the search query would be all 3 trans-1 entries.

How can I achieve this in Kibana?

If I do KQL:  
`NOT field-1 : null or NOT field-2 : null`  
I get trans-1, trans-2, trans-3 in my results

If I do KQL:  
`NOT field-1 : null and NOT field-2 : null`  
I get no results at all

Thanks in advance for your help!

---

<div class="post-metadata">

### Author: ![VietCong](https://avatars.discourse-cdn.com/v4/letter/v/e47774/32.png) [@VietCong](https://discuss.elastic.co/u/VietCong)
#### Post date: [December 15, 2019, 9:16pm UTC](https://discuss.elastic.co/t/search-query-with-or-over-separate-lines-for-same-id/211922/2 "2019-12-15T21:16:48Z")

</div>

I would do FIELD1:\* AND FIELD2:\* —\> this means return all documents where both field 1 and field 2 contains any value

---

<div class="post-metadata">

### Author: ![codak7](https://avatars.discourse-cdn.com/v4/letter/c/c68b51/32.png) [@codak7](https://discuss.elastic.co/u/codak7)
#### Post date: [December 16, 2019, 9:19am UTC](https://discuss.elastic.co/t/search-query-with-or-over-separate-lines-for-same-id/211922/3 "2019-12-16T09:19:56Z")

</div>

Hi,  
thank you for you answer.  
Unfortunately this is not the solution I am looking for.  
This Search still shows trans-1, trans-2, trans-3 and not just the trans-1 lines.

---

<div class="post-metadata">

### Author: ![VietCong](https://avatars.discourse-cdn.com/v4/letter/v/e47774/32.png) [@VietCong](https://discuss.elastic.co/u/VietCong)
#### Post date: [December 16, 2019, 1:43pm UTC](https://discuss.elastic.co/t/search-query-with-or-over-separate-lines-for-same-id/211922/4 "2019-12-16T13:43:34Z")

</div>

I think in your document “-“ is actually the litteral value of the field so when you search for field1:\* AND field2:\* it would still include fields with “-“ so I would try (field1:\* AND field2:\*) AND NOT (field1:”-“ OR field2:”-“) this would give you all records with values in field1 and field2 and not the “-“ value. I am still confused about your use of transaction\_id field so if this query I proposed isnt what you are looking for, can you clarify your final goal with query?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 13, 2020, 1:43pm UTC](https://discuss.elastic.co/t/search-query-with-or-over-separate-lines-for-same-id/211922/5 "2020-01-13T13:43:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.