# Sql in elasticsearch/kibana

**URL:** <https://discuss.elastic.co/t/sql-in-elasticsearch-kibana/164398>\
**Category:** Elasticsearch\
**Created:** [January 16, 2019, 1:55am UTC](https://discuss.elastic.co/t/sql-in-elasticsearch-kibana/164398 "2019-01-16T01:55:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lynnptilby](https://avatars.discourse-cdn.com/v4/letter/l/47e85d/32.png) [@lynnptilby](https://discuss.elastic.co/u/lynnptilby)\
**Post date:** [January 16, 2019, 1:55am UTC](https://discuss.elastic.co/t/sql-in-elasticsearch-kibana/164398/1 "2019-01-16T01:55:23Z")

</div>

We have a logstash file with documents like:

message:  
2018-11-22 07:23:44,374 :: HWM :: INFO :: ########## Service Status: {'weight': True, 'main\_cam': True, 'bp': True, 'scanner': True, 'oto\_nose': True, 'thermo': True, 'ox': True, 'oto\_ear': True, 'oto\_mouth': True}  
@timestamp:  
November 22nd 2018, 07:23:44.374  
loglevel:  
INFO  
\_id:  
I\_dxvmcBKIwFz2orGn-N  
\_type:  
\_doc  
\_index:  
kiosk-hwm-index  
\_score:  
-  
We need to do things like select all docs where main\_cam="False" . Basically queries of sub-queries of sub-queries. Users at our organization are familiar with SQL and would like to use it, as opposed to learning a new language. What is the best study/learning document you can suggest?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 16, 2019, 2:22am UTC](https://discuss.elastic.co/t/sql-in-elasticsearch-kibana/164398/2 "2019-01-16T02:22:47Z")

</div>

You really need to split the message contents into their own fields using grok first.

---

<div class="post-metadata">

**Author:** ![lynnptilby](https://avatars.discourse-cdn.com/v4/letter/l/47e85d/32.png) [@lynnptilby](https://discuss.elastic.co/u/lynnptilby)\
**Post date:** [January 16, 2019, 4:59pm UTC](https://discuss.elastic.co/t/sql-in-elasticsearch-kibana/164398/3 "2019-01-16T16:59:16Z")

</div>

Will do. THANK YOU!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 13, 2019, 4:59pm UTC](https://discuss.elastic.co/t/sql-in-elasticsearch-kibana/164398/4 "2019-02-13T16:59:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.