# Compare fields value
**URL:** https://discuss.elastic.co/t/compare-fields-value/311387
**Category:** Logstash
**Created:** [August 4, 2022, 9:02am UTC](https://discuss.elastic.co/t/compare-fields-value/311387 "2022-08-04T09:02:45Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)
#### Post date: [August 4, 2022, 9:02am UTC](https://discuss.elastic.co/t/compare-fields-value/311387/1 "2022-08-04T09:02:45Z")
Hi,
I would like if it is possible how to compare this value of two fields
- field1 : 123456XXXXXX1234
- field2 : 1234567890001234
I mean i want to do if first 6 chars and last 4 chars of field1 are similar to field2 then add mutate or do something...
Any help would be sincerely appreciate!
Thanks!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 4, 2022, 4:09pm UTC](https://discuss.elastic.co/t/compare-fields-value/311387/2 "2022-08-04T16:09:00Z")
You would need to extract those characters and then compare them. I have not tested this but perhaps
```
grok {
break_on_match => false
match => {
"[field1]" => "^(?<[@metadata][field1][start].{6}).*(?<[@metadata][field1][end]>.{4})$"
"[field2]" => "^(?<[@metadata][field2][start].{6}).*(?<[@metadata][field2][end]>.{4})$"
}
}
if [@metadata][field1][start] == [@metadata][field2][start] and [@metadata][field1][end] == [@metadata][field2][end] {
# Do something
}
```
---
### Author:  [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)
#### Post date: [August 5, 2022, 2:12pm UTC](https://discuss.elastic.co/t/compare-fields-value/311387/3 "2022-08-05T14:12:53Z")
It works if these two fields in the same documents yes but in my case these two fields are not in the same document 😕 i created a [new topic](https://discuss.elastic.co/t/compare-two-fields-with-different-documents/311529) for this
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 2, 2022, 2:13pm UTC](https://discuss.elastic.co/t/compare-fields-value/311387/4 "2022-09-02T14:13:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.