Title: Cross match multiple occurrences in elasticsearch
Tags: elasticsearch
Question: Let's say I have an elastic search data structure like this:
{"sender": "ab",
"receiver": "cd",
"tag": "case1"}
{"sender": "ef",
"receiver": "gh",
"tag": "case1"}
{"sender": "ab",
"receiver": "ij",
"tag": "case2"}
{"sender": "vw",
"receiver": "xy",
"tag": "case2"}
{"sender": "xy",
"receiver": "ab",
"tag": "case3"}
Now I want to find all senders or receivers that occur in more than one case. For example, if I query for a "cross match" for case1, case2 and case3, I should get ab as a result, since ab was a sender or receiver in documents of all three cases.
Another example: A cross-match-query for case2 and case3 should return ab and xy, since both appeared as senders or receivers in the specified cases.
How would I query this in elasticsearch - or even better directly in kibana?
Comment: I could use term aggregations for the different cases and compare/cross-check those in an external script, but I think this might be possible right inside ES itself. And I would love to create a dashboard-visualisation for this in Kibana as well...

Comment: So you're trying to find a tag if the send and receiver contain the search query?



{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 0, 'CommentCount': 2, 'ContentLicense': 'CC BY-SA 4.0', 'CreationDate': '2015:00:08/20/15', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<elasticsearch>', 'Title': 'Cross match multiple occurrences in elasticsearch', 'ViewCount': 64, 'id': 32112503, 'user_AboutMe': None, 'user_AccountId': 1649673.0, 'user_DisplayName': 'user1520506', 'user_Reputation': 51.0, 'user_Views': 4.0, 'user_id': 1520506.0}}