# Compare a value from current index against the previous day

**URL:** <https://discuss.elastic.co/t/compare-a-value-from-current-index-against-the-previous-day/43918>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [March 9, 2016, 3:52pm UTC](https://discuss.elastic.co/t/compare-a-value-from-current-index-against-the-previous-day/43918 "2016-03-09T15:52:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mick66](https://avatars.discourse-cdn.com/v4/letter/m/d2c977/32.png) [@mick66](https://discuss.elastic.co/u/mick66)\
**Post date:** [March 9, 2016, 3:52pm UTC](https://discuss.elastic.co/t/compare-a-value-from-current-index-against-the-previous-day/43918/1 "2016-03-09T15:52:43Z")

</div>

I have an overnight process that creates a daily index at 02:00 : myindex-YYYY-MM-DD

This index has eight fields, but I am interested in three:

server\_name  
id\_no  
result

The value of result will be either PASS or FAIL

I would like to create a watch that compares the index from today against the index from yesterday and alerts me of any changes to the result field value.

For example:

index1:

```
@datetime:2016-03-08
server_name: server1
id_no: 1.1
result: PASS

```

Index 2

```
 @datetime:2016-03-09
 server_name: server1
 id_no: 1.1
 result: FAIL

```

I would like to receive an alert that server1, id 1.1, result is now set to FAIL.

I am not sure if this is possible with Watcher, but any help that anyone could provide on this would be much appreciated.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [March 9, 2016, 4:21pm UTC](https://discuss.elastic.co/t/compare-a-value-from-current-index-against-the-previous-day/43918/2 "2016-03-09T16:21:37Z")

</div>

Hey,

I see two possibilities here.

First, use the [chained input](https://www.elastic.co/guide/en/watcher/current/input.html#input-chain), and run two different search requests and then use the compare condition to compare them.

Second, be able to write a single search query that returns both results (maybe by using aggs) and compare that output.

The first solution sounds better from my outside view, but if it is easy to create a single query, go with that.

Hope this helps.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:46pm UTC](https://discuss.elastic.co/t/compare-a-value-from-current-index-against-the-previous-day/43918/3 "2017-07-06T13:46:42Z")

</div>