0
votes

I am completely new to ELK stack. I am using a filter like field1:value1 and get back documents as results. On 1 of those returned documents there are field2:value2, I am interested in field2:value2 and would like to filter further on that. So value2 kind of dynamic, i.e not known ahead of time. The final result I want is all documents returned from field1 and field2

Is there a way to make a filter to do that automatically, i.e I just have to input value1 and it will filter, find value2 and filter once again and finally return all documents from both filter actions?

1

1 Answers

0
votes

If I understand you correctly you can use _exists_:<field> on kibana to filter documents that have that field.

field1:value1 AND __exist__:field2 AND field:value2