Comparing the different document field values

Just wondering How can I compare the value from 2 different documents . I am ingesting the following values in the index.

I am looking to query and compare of each document field "type_instance" value of "allocated-mb" > "max-mb" of the each plugin_instance .

POST test/_bulk
{"plugin_instance": "root-yarn-queue-name-1", "type_instance": "allocated-mb", "value": 4024}
{ "plugin_instance": "root-yarn-queue-name-1", "type_instance": "max-mb", "value": 2048}
{"plugin_instance": "root-yarn-queue-name-2", "type_instance": "max-mb", "value": 3048}
{"root-yarn-queue-name-2", "type_instance": "allocated-mb", "value": 1028}
{"plugin_instance": "some-random-queue-name-2", "type_instance": "allocated-mb", "value": 2028}
{"plugin_instance": "some-random-queue-name-2", "type_instance": "max-mb", "value": 2028}

just wonder what would the easy way to achieve following

  1. Select records with plugin_instance=root-yarn-queue-name-*
  2. select records with type_instance in (allocated-mb, allocated-vcores, max-mb, max-vcores)
  3. group records with same plugin_instance (to get records for a queue in a bucket)
  4. compare if value of allocated-mb > max-mb and allocated-vcore > max-vcore
    and select those records which fulfil all these conditions in a given time period

till now I have managed to bucket the document based on the plugin_instance . Wondering what would be the easy way to compare the documents of each bucket based on the "type_instance"

    GET test/_search
      "query": {
        "query_string": {
          "default_field": "plugin_instance.keyword",
          "query": "root-yarn-queue-name-*"
      "aggs": {
        "byField": {
          "terms": {
            "field": "plugin_instance.keyword"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.