Search for aggregate root id

I try to bring Event Sourcing to my project but not sure how to do a specific thing in a less errorful way.

This is an "accounting" system but the main focus is on transactions, not on accounts. The thing is that I receive such events as withdrawal or deposit was made, authorization hold was created/decreased/increased/expired/reversed, authorization hold was settled (it means that there will soon be an event for withdrawal), and event with transaction details.

In my case aggregate root is a transaction. It could be created (via authorization hold or directly with withdrawal/deposit events) and updated.

Ane here what I can not fully understand. I get the very first event with authorization hold created. Inside this event, I have only the amount and key for this authorization hold. The key comes from the external system, oviusly. So, I generated a new TransactionId with UUID4, make a new aggregate root, add the first event, and persist it. Next, I receive an event withdrawal was created. This event has amount, transaction key some other data, and may have a key with authorization hold reference in the external system. If it does not have such a key then I simply generate a new TransactionId and store a new aggregate. But if there is such a key then I need to load previous aggregate which was created during the authorization hold created event.

The problem is that withdrawal events do not have aggregate root id from my system. Correct me if I'm wrong but I consider the following flow

• check if the withdrawal created event has reference to an authorization hold
• if there the reference is not in the event
  • create a new Transaction aggregate with withdrawal created event
• if the event has the reference
  • find the authorization hold created event which has this value in its payload
  • get an aggregate id for the founded event
  • load all events for this aggregated id and build the aggregated root
  • add withdrawal created to the aggregated and persist it

Is it correct?

To make the question more abstract and generic. If I do not get aggregate root id in incoming messages then is it ok/valid to search for specific aggregate root id in an event store by some criteria which I build on the values of incoming data?

You can't/shouldn't query the event store for some criteria from your aggregates, instead the client should first query the read-side to see if related aggregates exists or not and then add those ID's to the command to the aggregates.