# Comparing 2 indices or 2 set of docs **URL:** \ **Category:** Elasticsearch\ **Created:** [September 28, 2015, 8:16pm UTC](https://discuss.elastic.co/t/comparing-2-indices-or-2-set-of-docs/31291 "2015-09-28T20:16:20Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![noelyim](https://avatars.discourse-cdn.com/v4/letter/n/8491ac/32.png) [@noelyim](https://discuss.elastic.co/u/noelyim)\ **Post date:** [September 28, 2015, 8:16pm UTC](https://discuss.elastic.co/t/comparing-2-indices-or-2-set-of-docs/31291/1 "2015-09-28T20:16:20Z")
Continuing the discussion from [Comparing 2 sources of log input ( using fuzzy? hash? term ?)](https://discuss.elastic.co/t/comparing-2-sources-of-log-input-using-fuzzy-hash-term/29256): > [@Comparing 2 sources of log input ( using fuzzy? hash? term ?)](https://discuss.elastic.co/t/comparing-2-sources-of-log-input-using-fuzzy-hash-term/29256/2): > > ine diffs So, I am trying to get a range of messages using timestamps from 2 different data source and compare them see if they match (say match on particular timestamp & messageid combination) Should I do comparison on multiple message using the following? 1. they are 2 different indices Or 2. create 2 different docs (doc\_a and doc\_b) under the same index? And how to do comparison between messages (timeA-timeB) from source 1 and source 2. I look into mlt, it doesn't seem to be for comparing 2 arrays of messages. ---
**Author:** ![noelyim](https://avatars.discourse-cdn.com/v4/letter/n/8491ac/32.png) [@noelyim](https://discuss.elastic.co/u/noelyim)\ **Post date:** [September 28, 2015, 9:11pm UTC](https://discuss.elastic.co/t/comparing-2-indices-or-2-set-of-docs/31291/2 "2015-09-28T21:11:21Z")
Any suggestions? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 29, 2015, 12:35pm UTC](https://discuss.elastic.co/t/comparing-2-indices-or-2-set-of-docs/31291/3 "2015-09-29T12:35:35Z")
You can't do a join type query in ES, so you'd either need to extract the docs and then compare them externally, or index them into the same index. ---
**Author:** ![noelyim](https://avatars.discourse-cdn.com/v4/letter/n/8491ac/32.png) [@noelyim](https://discuss.elastic.co/u/noelyim)\ **Post date:** [September 29, 2015, 12:53pm UTC](https://discuss.elastic.co/t/comparing-2-indices-or-2-set-of-docs/31291/4 "2015-09-29T12:53:58Z")
Ok. Say I index them into one index and give them different doc names (doc\_a stuffs, and doc\_b stuffs) how do I do a comparison? Thanks ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 29, 2015, 2:00pm UTC](https://discuss.elastic.co/t/comparing-2-indices-or-2-set-of-docs/31291/5 "2015-09-29T14:00:54Z")
What do you want to compare exactly? ---
**Author:** ![noelyim](https://avatars.discourse-cdn.com/v4/letter/n/8491ac/32.png) [@noelyim](https://discuss.elastic.co/u/noelyim)\ **Post date:** [September 29, 2015, 2:46pm UTC](https://discuss.elastic.co/t/comparing-2-indices-or-2-set-of-docs/31291/6 "2015-09-29T14:46:17Z")
I would like to compare 2 fields from the docs. It seems aggregations would be a good option. For example, - Each message has field seqnumber and field timestamp. Each doc has multiple messages. - I put both doc\_a and doc\_b stuffs in index. - Using aggs, term field "seqnumber" , it should put seqnumber as bucket key and doc\_count. 1. I tried, and not able to get the doc count as 2 when I put 2 identical set of message in the two docs?? field : seqnumber should show the total of doc\_a.seqnumber and doc\_b.seqnumber But my result buckets did not have the correct number of total. 2. Another question is I don't know how to get a combination of seqnumber field and timestamp field as aggs buckets. Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:47pm UTC](https://discuss.elastic.co/t/comparing-2-indices-or-2-set-of-docs/31291/7 "2017-07-05T23:47:33Z")