# Comparing data from two different source

**URL:** <https://discuss.elastic.co/t/comparing-data-from-two-different-source/200616>\
**Category:** Logstash\
**Created:** [September 23, 2019, 3:02am UTC](https://discuss.elastic.co/t/comparing-data-from-two-different-source/200616 "2019-09-23T03:02:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Donny\_Nightfrost](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/donny_nightfrost/32/43536_2.png) [@Donny\_Nightfrost](https://discuss.elastic.co/u/Donny_Nightfrost)\
**Post date:** [September 23, 2019, 3:02am UTC](https://discuss.elastic.co/t/comparing-data-from-two-different-source/200616/1 "2019-09-23T03:02:43Z")

</div>

Greetings, everyone. I have a trouble on comparing two data sources. What i want to do is check message field on "/var/log/auth.log" and see if it contains a word / string from "test" database table. Is this the right way to do the matching?

```
input {
jdbc
  {
    jdbc_driver_class => "com.mysql.jdbc.Driver"
    jdbc_driver_library => "/home/donny/Downloads/mysql-connector-java-8.0.17.jar"
    jdbc_connection_string => "jdbc:mysql://192.168.43.250/siem"
    jdbc_user => "root"
    jdbc_password => "toor"
    schedule => "* * * * *"
    statement => ["SELECT * FROM test"]
  }

#jdbc
# {
# jdbc_driver_class => "com.mysql.jdbc.Driver"
# jdbc_driver_library => "/home/donny/Downloads/mysql-connector-java-8.0.17.jar"
# jdbc_connection_string => "jdbc:mysql://192.168.43.250/siem?user=root&password=toor"
# jdbc_user => "root"
# jdbc_password => "toor"
# schedule => "* * * * *"
# statement => ["SELECT * FROM asset"]
# }

	file {
	path => "/var/log/auth.log"
	     }

}

filter {

#jdbc_streaming {
#	jdbc_driver_class => "com.mysql.jdbc.Driver"
# jdbc_driver_library => "/home/donny/Downloads/mysql-connector-java-8.0.17.jar"
# jdbc_connection_string => "jdbc:mysql://192.168.43.250/siem"
# jdbc_user => "root"
# jdbc_password => "toor"        
#	statement => "SELECT evdesc FROM test"
# parameters => { "evdesc" => "evlock"}
# target => "evlock"
# }

if [message] in [evdesc] {
  mutate {
    add_field => {
      "exists in database" => true
    }
  }
}

}
output {

elasticsearch
  {
    hosts => ["192.168.43.250:9200"]
    index => "correlation-%{+YYYY.MM.dd}"
  }

stdout{ codec => rubydebug }

}
```

I tried running above configurations but didnt see the new field added in Kibana. Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Donny\_Nightfrost](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/donny_nightfrost/32/43536_2.png) [@Donny\_Nightfrost](https://discuss.elastic.co/u/Donny_Nightfrost)\
**Post date:** [September 24, 2019, 1:45am UTC](https://discuss.elastic.co/t/comparing-data-from-two-different-source/200616/2 "2019-09-24T01:45:25Z")

</div>

anyone?

---

<div class="post-metadata">

**Author:** ![chandu5565](https://avatars.discourse-cdn.com/v4/letter/c/c57346/32.png) [@chandu5565](https://discuss.elastic.co/u/chandu5565)\
**Post date:** [September 24, 2019, 9:51am UTC](https://discuss.elastic.co/t/comparing-data-from-two-different-source/200616/3 "2019-09-24T09:51:46Z")

</div>

Can you post the stdout of the configuration how the data is parsed

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 22, 2019, 9:51am UTC](https://discuss.elastic.co/t/comparing-data-from-two-different-source/200616/4 "2019-10-22T09:51:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.