I have multiple sets of user session start and end events. I would like to slice the logs within session start and end time frame. Then group them as events occurred within user session. I don't have any ID to uniquely identify a session. All I have is just logs for session start and end. Is there a way to accomplish this in elastic search?
date: 2016-10-25T02:12:22.234Z, message: "Session Started", UserID: 42342342
date: 2016-10-25T02:12:24.234Z, message: "User clicked the page My Account", UserID: 42342342
date: 2016-10-25T02:12:27.234Z, message: "User added item", UserID: 42342342
date: 2016-10-25T02:12:30.234Z message: Session ended "My Account", UserID: 42342342
In the above sample, I would like to slice and bucket the middle two logs for different sessions.