# Compare fields from different index pattern using a scripted field

**URL:** <https://discuss.elastic.co/t/compare-fields-from-different-index-pattern-using-a-scripted-field/161632>\
**Category:** Kibana\
**Created:** [December 20, 2018, 7:02am UTC](https://discuss.elastic.co/t/compare-fields-from-different-index-pattern-using-a-scripted-field/161632 "2018-12-20T07:02:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sanj](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@Sanj](https://discuss.elastic.co/u/Sanj)\
**Post date:** [December 20, 2018, 7:02am UTC](https://discuss.elastic.co/t/compare-fields-from-different-index-pattern-using-a-scripted-field/161632/1 "2018-12-20T07:02:37Z")

</div>

Hi Team,  
My scenario is that I need to compare fields from two different data.  
I have three fields named "Server", "Name" and "Size". Say I'll be getting data from two servers (i.e) server1 and server2. these servers will be having some common "Name" values like 'Name1', 'Name2', 'Name3', etc,. and will be having their corresponding "Size" values.

I'm displaying server1 and server2 data in 2 individual datatable. What I'm trying to do is comparing fields from server1 and server2 and displaying them in colors based on the result.  
Typically scenario would be like,

> If (('server1.Name') == ('server2.name')){  
> if( 'server1.size' == server2.size) {  
> _should display the 'Size' value in green colour in the datatable_  
> }else{  
> _should display the 'Size' value in red colour in the datatable_  
> }

How can I acheive this?  
**Case 1** :  
_Should i create a scripted field to compare these parameters?_

Say I'm parsing both server data into a single index pattern. The server1 and server2 data will be in two separate entries.As mentioned in the documentation " **_Script Fields Allows to return a script evaluation (based on different fields) for each hit_**"  
how can i compare two different entries using Scripted fields. ?

**Case 2** :  
_Should I parse server1 and server2 data into two different index patterns and compare them?_

Can we compare data from two different index pattern ? if yes kindly let me know how so that i can make some progress with my issue.

Since I'm a newbie to these stuffs, any sort of idea or help would be really helpful for me to proceed further.

Thank you in advance.

---

<div class="post-metadata">

**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\
**Post date:** [December 20, 2018, 6:32pm UTC](https://discuss.elastic.co/t/compare-fields-from-different-index-pattern-using-a-scripted-field/161632/2 "2018-12-20T18:32:31Z")

</div>

It's not really possible to compare two different entries using a scripted field.

Could you show an example document?

---

<div class="post-metadata">

**Author:** ![Sanj](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@Sanj](https://discuss.elastic.co/u/Sanj)\
**Post date:** [December 21, 2018, 9:42am UTC](https://discuss.elastic.co/t/compare-fields-from-different-index-pattern-using-a-scripted-field/161632/3 "2018-12-21T09:42:09Z")

</div>

@lukas Thank you for the response mate.

I'm parsing Json data from a webservice using http\_poller input. These server data which i have mentioned above come from two different web services.

Sample data will be like

> ```
> {
> "agentId": "TMS",
> "apiVersion": "v2",
> "entities": [{
> "agentId": "server1",
> "name": "UPCWOCHKDGT",
> "cacheManagerName": "RT_Article_CacheMgr",
> "attributes": {
> "Size": 801225
> }
> }, {
> "agentId": "server1",
> "name": "XRefUPC14Digit",
> "cacheManagerName": "RT_Article_CacheMgr",
> "attributes": {
> "Size": 984362
> }
> }]
> }
> 
> ```

like this I'll be having a json for server2.

 ![2018-12-21%2015_04_39-Discover%20-%20Kibana](https://us1.discourse-cdn.com/elastic/original/3X/d/8/d8bf78da9401e69caebddf8d9d3292ce6071ca87.png)

This is how the data looks in my kibana.

Thank you !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 18, 2019, 9:42am UTC](https://discuss.elastic.co/t/compare-fields-from-different-index-pattern-using-a-scripted-field/161632/4 "2019-01-18T09:42:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.