Compare two same filed value from two different indexes

[elkparser]

Hi,

I have a data like this:

index1: sample_2020_01_21 in this index i have data:

{
"jobName":"ABC"
"jobduration": 20
}

index1: sample_2020_01_20 in this index i have data:

{
"jobName":"ABC"
"jobduration": 40
}

Like that I have daily indexes with some amount of documents, form that indexes I need to query the data based on jobduration to check current day job running is more time on not.
if that current jobs are running more time then we need to index those documents into other index.

Actually it can possible by using watcher with chain input format, but problem here is no watcher for us, i need plain query language to get this output.

Can you please help me

[grumo35]

Hi,

You should try to use index aliases, documentation

[elkparser]

Hi Grumo35,

Thanks for sharing this, Can you share the to compare same filed from two indexes.

If possible please share highly appreciated