# Compare Two Indices using Watcher

**URL:** <https://discuss.elastic.co/t/compare-two-indices-using-watcher/84101>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [April 30, 2017, 12:42am UTC](https://discuss.elastic.co/t/compare-two-indices-using-watcher/84101 "2017-04-30T00:42:17Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![adonahoe](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@adonahoe](https://discuss.elastic.co/u/adonahoe)\
**Post date:** [April 30, 2017, 12:42am UTC](https://discuss.elastic.co/t/compare-two-indices-using-watcher/84101/1 "2017-04-30T00:42:17Z")

</div>

Hello All,

I was wondering how I could possible compare two indices using watcher? For instance lets say I have one index with firewall data and I have another index that contains a blacklist. I was wondering how I could possibly compare all IPs in the firewall data index against all the blacklist IPs in the blacklist\_IP index?

Any ideas would be great!

Thanks!

---

<div class="post-metadata">

**Author:** ![pts0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pts0/32/17811_2.png) [@pts0](https://discuss.elastic.co/u/pts0)\
**Post date:** [April 30, 2017, 4:13pm UTC](https://discuss.elastic.co/t/compare-two-indices-using-watcher/84101/2 "2017-04-30T16:13:47Z")

</div>

Hi,  
sure is possible to compare two index. I do it with input chain:  
[https://www.elastic.co/guide/en/watcher/current/input.html#input-chain](https://www.elastic.co/guide/en/watcher/current/input.html#input-chain)  
and then u can evaluate it with painless scripts.

Cheers  
pts0

---

<div class="post-metadata">

**Author:** ![adonahoe](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@adonahoe](https://discuss.elastic.co/u/adonahoe)\
**Post date:** [May 1, 2017, 10:24am UTC](https://discuss.elastic.co/t/compare-two-indices-using-watcher/84101/3 "2017-05-01T10:24:13Z")

</div>

Thank you for the response! I did see input-chain and was wondering how hard is that to actually implement and whether or not you have a possible example you could show?

Currently I am using a python script to query between the two indices which seems to work fairly well but I would like to make a more pure solution which does not rely on a python script to do my matching for me.

Was wondering what people thought about each approach and which approach would be more scalable/easier to implement.

---

<div class="post-metadata">

**Author:** ![pts0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pts0/32/17811_2.png) [@pts0](https://discuss.elastic.co/u/pts0)\
**Post date:** [May 2, 2017, 8:25pm UTC](https://discuss.elastic.co/t/compare-two-indices-using-watcher/84101/4 "2017-05-02T20:25:20Z")

</div>

Hi,  
I don't have now the example here, but if you post more detail is not a big deal to get it build.  
Python script could be ok too, but is not running on elastic i imagine.  
I think watcher would be easier to maintain and scale/monitor

---

<div class="post-metadata">

**Author:** ![adonahoe](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@adonahoe](https://discuss.elastic.co/u/adonahoe)\
**Post date:** [May 5, 2017, 4:46am UTC](https://discuss.elastic.co/t/compare-two-indices-using-watcher/84101/5 "2017-05-05T04:46:49Z")

</div>

Thanks for the response! Below is an example of two basic mappings for the index blacklist and the index firewall. How would I go about creating a simple watcher to compare all of the IPs in the blacklist index against the ones in the firewall index?

PUT blacklist  
{  
"mappings": {  
"bl": {  
"\_all": {  
"enabled": false  
},  
"properties": {  
"B-IP": {  
"type": "text"  
}  
}  
}  
}  
}

PUT firewall  
{  
"mappings": {  
"fw": {  
"\_all": {  
"enabled": false  
},  
"properties": {  
"SRC-IP": {  
"type": "text"  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [May 15, 2017, 9:07pm UTC](https://discuss.elastic.co/t/compare-two-indices-using-watcher/84101/6 "2017-05-15T21:07:59Z")

</div>

Hey,

I am not sure what 'comparing' means in this context exactly. If you have some ips in your blacklist, you could either put those into the watch metadata or try to have a chained input that queries for the blacklist first and for the data second - again this highly depends on your use-case and data model, so it's hard to give a useful answer here.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2017, 9:09pm UTC](https://discuss.elastic.co/t/compare-two-indices-using-watcher/84101/7 "2017-06-12T21:09:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.