We have below log event rows -  correlationKey=abc msg="create cache for 123" correlationKey=abc "read cache for 123" correlationKey=mno "create cache for 456" correlationKey=mno "read cache for 456" correlationKey=xyz "read cache for 123" From the data, we may notice that correlationKey abc/mno have both create/read. But for correlationKey xyz, it does not have "create cache" log, but "read cache" only. We need to find all correlationKey values w/o log entry "create cache for". (abc/mno do not qualify. Only xyz qualify.) Appreciate your great help! - ET ... View more