Hello, This is my first post, so I apologize if I'm lacking in some sort of post etiquette or other guidelines. I'm trying to execute a query over a database of logs, where different types of logs have different fields. I'd like my query to accomplish two things: 1) search for logs of type A, and group results based on field 1 (integer field), field 2 (integer field), and field 3 (string field) (the aggregation operator will be a count) I know how to accomplish step 1 logType=A (fieldA=5* OR fieldA=4*) | stats count BY fieldA, fieldB, fieldC | sort -count +desc the tricky part is completing step 2 2) for each result in query 1 (our subsearch), search for all logs of type B such that field 4 (a string field in log type B, that logs of type A do NOT contain) contains field 2 (cast to a string, as field 2 holds integers for logs of type A and we are seeing if the text value of this integer is in field 4) and contains field 3.  By contains, I mean in the literal String.contains() meaning. Field 4 will be a very long message stored in a string, and will contain the values stored in fields 2 and 3 of log type A. I'm searching for logs of type B that correspond to the specific logs of type A that were returned in my subsearch. logs of type B do not contains fields 1, 2, or 3, so I need to extract these fields from logs of type A, then see if field 4 in logs of type B contain these values. Is there any way to do this in one query? The first problem that I've come across is that subsearches are (I believe) meant to return one result, whereas mine must return multiple results. Furthermore, subsearches are meant to add an extra parameter, or narrow down your outer search, but the log type I'm searching over in my outer search doesn't contain the fields that my subsearch produces. Any help on this would be greatly appreciated! ... View more