# Compare field value of two different index

**URL:** <https://discuss.elastic.co/t/compare-field-value-of-two-different-index/132290>\
**Category:** Elasticsearch\
**Created:** [May 17, 2018, 9:16am UTC](https://discuss.elastic.co/t/compare-field-value-of-two-different-index/132290 "2018-05-17T09:16:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![addanuj](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@addanuj](https://discuss.elastic.co/u/addanuj)\
**Post date:** [May 17, 2018, 9:16am UTC](https://discuss.elastic.co/t/compare-field-value-of-two-different-index/132290/1 "2018-05-17T09:16:54Z")

</div>

Hi @spinscale

please guide me.. please guide me to the following problem,  
I have two different index and i want to compare two fields value and get result which exist in different index

for example :-  
Index 1: threatintel  
fields :- 1. indicator\_ip  
2. message  
3. userid

Index 2: checkpoint  
fields:- 1. srcip  
2. dstip

Need query : Give source IP, message and timestamp  
where threatintel.indicator\_ip = (checkpoint.srcip or checkpoint.dstip)

please help me to achieve it.

---

<div class="post-metadata">

**Author:** ![RahulD](https://avatars.discourse-cdn.com/v4/letter/r/da6949/32.png) [@RahulD](https://discuss.elastic.co/u/RahulD)\
**Post date:** [May 17, 2018, 11:00am UTC](https://discuss.elastic.co/t/compare-field-value-of-two-different-index/132290/2 "2018-05-17T11:00:01Z")

</div>

I don't think this is possible in ES. You are trying to implement a sql like join which is not possible in ES. Two ways you can achieve this is:

1- At index time create a combined document  
2- Do the join in your application

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 14, 2018, 11:00am UTC](https://discuss.elastic.co/t/compare-field-value-of-two-different-index/132290/3 "2018-06-14T11:00:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.