怎么做日志聚合归类

假如已经通过Filebeat或者Logstash已经把log存到ElasticSearch里了，怎么把有相同Pattern的log归到一个类别中
譬如如下
Fail in processing order 00001 for user [abc].......
Fail in processing order 00002 for user [cde].......
Fail in processing order 00003 for user [zhangsan].......
Fail in processing order 00001 for user [lisi].......
Log中可能有很多的Pattern,有什么方式ES能自己去找到Pattern相同的log
还有另外一个需求譬如说对于一个订单
Create order 00001 for user [abc] at 2019-04-22 22:00:11
Payment completed for order 00001 for user [abc] at 2019-04-22 22:10:11
有什么方法可以计算这两个事件的间隔