# Successful Deposit Query advice

**URL:** <https://discuss.elastic.co/t/successful-deposit-query-advice/150644>\
**Category:** Elasticsearch\
**Created:** [October 2, 2018, 4:55am UTC](https://discuss.elastic.co/t/successful-deposit-query-advice/150644 "2018-10-02T04:55:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Inammathe\_Inna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inammathe_inna/32/40656_2.png) [@Inammathe\_Inna](https://discuss.elastic.co/u/Inammathe_Inna)\
**Post date:** [October 2, 2018, 4:55am UTC](https://discuss.elastic.co/t/successful-deposit-query-advice/150644/1 "2018-10-02T04:55:28Z")

</div>

Hey guys!

I am pretty sure I am in the wrong mindset for this sort of query so I would appreciate any nudges in the right direction

So my use case:  
I want all CreditCardDeposit requests  
where the response (same UUID as the request) ErrorNo is 0

My currently mapped fields:  
OperationType: ["Request","Reply"]  
DepositAmount: int  
ErrorNo: int  
UUID: string

A successful deposit is in sql terms:

OperationName = CreditCardDeposit  
AND Reply ErrorNo = 0  
JOIN on Request UUID = Reply UUID

Requests and Replies are logged on separate lines (app exists between front end and hosts)

Since this query doesn't appear terribly complicated, is there a way I can structure a `Get /my_index/_search` query to accomplish this? Or do I need to think more about how I should be storing this data? If so, any tips?

Thanks!

---

<div class="post-metadata">

**Author:** ![Inammathe\_Inna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inammathe_inna/32/40656_2.png) [@Inammathe\_Inna](https://discuss.elastic.co/u/Inammathe_Inna)\
**Post date:** [October 7, 2018, 10:50pm UTC](https://discuss.elastic.co/t/successful-deposit-query-advice/150644/3 "2018-10-07T22:50:08Z")

</div>

Hey Abdon,  
Thank you for your reply. That query works! I wouldn't have thought to use aggregations like that.

I am intrigued though about:

> create a single document per UUID, and update that document each time a new event occurs for that UUID

Do you know if that is something I can accomplish within a Logstash pipeline? I am guessing something along the lines of..

> if (OperationType=response) { (Add fields to document) where request.UUID == response.UUID }

Thanks again for your help. We've only just started using ELK at work and I am still getting the hang of things 🙂

Ev

---

<div class="post-metadata">

**Author:** ![Inammathe\_Inna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inammathe_inna/32/40656_2.png) [@Inammathe\_Inna](https://discuss.elastic.co/u/Inammathe_Inna)\
**Post date:** [October 8, 2018, 12:11am UTC](https://discuss.elastic.co/t/successful-deposit-query-advice/150644/4 "2018-10-08T00:11:35Z")

</div>

nvm just found it, good old action method in the elastic output.  
This is actual waaaaay more practical. Thank you Thank you Thank you Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 5, 2018, 12:11am UTC](https://discuss.elastic.co/t/successful-deposit-query-advice/150644/5 "2018-11-05T00:11:38Z")

</div>

Closed on November 5, 2018, 12:11am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.