# Compare two fields and achieve a left outer comparison

**URL:** <https://discuss.elastic.co/t/compare-two-fields-and-achieve-a-left-outer-comparison/255377>\
**Category:** Elasticsearch\
**Created:** [November 13, 2020, 8:07pm UTC](https://discuss.elastic.co/t/compare-two-fields-and-achieve-a-left-outer-comparison/255377 "2020-11-13T20:07:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\
**Post date:** [November 13, 2020, 8:07pm UTC](https://discuss.elastic.co/t/compare-two-fields-and-achieve-a-left-outer-comparison/255377/1 "2020-11-13T20:07:44Z")

</div>

I've following data

```auto
{ "index" : { "_index" : "host_compare", "_id" : "1" } }
{ "host_name" : "myhost2" , "host_count" : "10", "@timestamp": "2020-11-12T02:00:00Z" }
{ "index" : { "_index" : "host_compare", "_id" : "3" } }
{ "host_name" : "myhost2" , "host_count" : "20", "@timestamp": "2020-11-11T02:00:00Z" }
{ "index" : { "_index" : "host_compare", "_id" : "4" } }
{ "host_name" : "myhost3" , "host_count" : "20", "@timestamp": "2020-11-11T02:00:00Z" }
{ "index" : { "_index" : "host_compare", "_id" : "5" } }
{ "host_name" : "myhost4" , "host_count" : "20", "@timestamp": "2020-11-11T02:00:00Z" }

```

So its all in same index. I wanted to see if any `host_name` is not present on `2020-11-12`, but was present on `2020-11-11`. How is it possible to achieve this via DSL?

So my final outcome, I'm lookig for is something like.. (as host2 was present in both days)

```auto
   host_name   
---------------
myhost3        
myhost4  

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 17, 2020, 11:16pm UTC](https://discuss.elastic.co/t/compare-two-fields-and-achieve-a-left-outer-comparison/255377/2 "2020-11-17T23:16:11Z")

</div>

I don't believe there's a specific query to handle this. You should be able to do this with a Watch like [this one](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/new_process_started) though.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 15, 2020, 11:16pm UTC](https://discuss.elastic.co/t/compare-two-fields-and-achieve-a-left-outer-comparison/255377/3 "2020-12-15T23:16:16Z")

</div>

Closed on December 15, 2020, 11:16pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.