Compare 2 fields in Search - Kibana

[snambu5878 (snambu)]

Hi Team,

We were asked a question by business whether we can produce a search result comparing 2 fields. 

For Ex:    submitted_amt > paid_amt

Usually In Kibana we can do submitted_amt >= or <= 1000 on a value. The requirement here is compare with 2 different column fields. I see some blogs that tells us to use scripted fields but they are not searchable. There is this enhanced table plugin that we can  use but not sure if it is searchable and the plugin has issues searching large data sets.

Appreciate your quick help on this.

Thanks,
Sri

[mattkime (Matthew Kime)]

@snambu5878

Which version of Kibana are you using? You can certainly filter on scripted fields - https://www.elastic.co/guide/en/kibana/current/scripted-fields.html - although it would be helpful to verify this is true for the version you're running.

Thanks,
Matt

[snambu5878 (snambu)]

Thanks for your reply. Our Kibana version is 7.6.0

Here in the scripted fields I see search is not enabled.

Regards,
Sri

[mattkime (Matthew Kime)]

From the url I provided -

You query scripted fields with the [Kibana query language](https://www.elastic.co/guide/en/kibana/current/kuery-query.html), and can filter them using the filter bar.

I would say that text is misleading and perhaps should be removed.

[snambu5878 (snambu)]

Thanks for your reply. But we are looking for search and filter is not an option. Is there any other option that you can recommend?

Thanks,
Sri

[mattkime (Matthew Kime)]

Can you show me the search you wish to perform?

[snambu5878 (snambu)]

Sure Matt. Something like below. This is just illustration on how we would like to have. Actual columns may vary.

[mattkime (Matthew Kime)]

I'm doing some research into how scripting fields can help. It seems they should be able to even with their limitations.

Another option would be to update the documents - https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-update.html