Compare fields from different index pattern using a scripted field

Hi Team,
My scenario is that I need to compare fields from two different data.
I have three fields named "Server", "Name" and "Size". Say I'll be getting data from two servers (i.e) server1 and server2. these servers will be having some common "Name" values like 'Name1', 'Name2', 'Name3', etc,. and will be having their corresponding "Size" values.

I'm displaying server1 and server2 data in 2 individual datatable. What I'm trying to do is comparing fields from server1 and server2 and displaying them in colors based on the result.
Typically scenario would be like,

If (('server1.Name') == ('server2.name')){
if( 'server1.size' == server2.size) {
should display the 'Size' value in green colour in the datatable
}else{
should display the 'Size' value in red colour in the datatable
}

How can I acheive this?
Case 1:
Should i create a scripted field to compare these parameters?

Say I'm parsing both server data into a single index pattern. The server1 and server2 data will be in two separate entries.As mentioned in the documentation " Script Fields Allows to return a script evaluation (based on different fields) for each hit"
how can i compare two different entries using Scripted fields. ?

Case 2:
Should I parse server1 and server2 data into two different index patterns and compare them?

Can we compare data from two different index pattern ? if yes kindly let me know how so that i can make some progress with my issue.

Since I'm a newbie to these stuffs, any sort of idea or help would be really helpful for me to proceed further.

Thank you in advance.

It's not really possible to compare two different entries using a scripted field.

Could you show an example document?

@lukas Thank you for the response mate.

I'm parsing Json data from a webservice using http_poller input. These server data which i have mentioned above come from two different web services.

Sample data will be like

{
    		"agentId": "TMS",
    		"apiVersion": "v2",
    		"entities": [{
    			"agentId": "server1",
    			"name": "UPCWOCHKDGT",
    			"cacheManagerName": "RT_Article_CacheMgr",
    			"attributes": {
    				"Size": 801225
    			}
    		}, {
    			"agentId": "server1",
    			"name": "XRefUPC14Digit",
    			"cacheManagerName": "RT_Article_CacheMgr",
    			"attributes": {
    				"Size": 984362
    			}
    		}]
    	}

like this I'll be having a json for server2.

This is how the data looks in my kibana.

Thank you !

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.