Compare fields value

[alex_vermex]

Hi,
I would like if it is possible how to compare this value of two fields

• field1 : 123456XXXXXX1234
• field2 : 1234567890001234

I mean i want to do if first 6 chars and last 4 chars of field1 are similar to field2 then add mutate or do something...

Any help would be sincerely appreciate!
Thanks!

[Badger]

You would need to extract those characters and then compare them. I have not tested this but perhaps

grok {
    break_on_match => false
    match => {
        "[field1]" => "^(?<[@metadata][field1][start].{6}).*(?<[@metadata][field1][end]>.{4})$"
        "[field2]" => "^(?<[@metadata][field2][start].{6}).*(?<[@metadata][field2][end]>.{4})$"
    }
}
if [@metadata][field1][start] == [@metadata][field2][start] and [@metadata][field1][end] == [@metadata][field2][end] {
    # Do something
}

[alex_vermex]

It works if these two fields in the same documents yes but in my case these two fields are not in the same document i created a new topic for this