Comparing the different document field values

[mussa572 (Musa)]

Hi
Just wondering How can I compare the value from 2 different documents . I am ingesting the following values in the index.

I am looking to query and compare of each document field "type_instance" value of "allocated-mb" > "max-mb" of the each plugin_instance .

POST test/_bulk
{"index":{"_id":1}}
{"plugin_instance": "root-yarn-queue-name-1", "type_instance": "allocated-mb", "value": 4024}
{"index":{"_id":2}}
{ "plugin_instance": "root-yarn-queue-name-1", "type_instance": "max-mb", "value": 2048}
{"index":{"_id":3}}
{"plugin_instance": "root-yarn-queue-name-2", "type_instance": "max-mb", "value": 3048}
{"index":{"_id":4}}
{"root-yarn-queue-name-2", "type_instance": "allocated-mb", "value": 1028}
{"index":{"_id":5}}
{"plugin_instance": "some-random-queue-name-2", "type_instance": "allocated-mb", "value": 2028}
{"index":{"_id":6}}
{"plugin_instance": "some-random-queue-name-2", "type_instance": "max-mb", "value": 2028}

---

just wonder what would the easy way to achieve following

1. Select records with plugin_instance=root-yarn-queue-name-*
2. select records with type_instance in (allocated-mb, allocated-vcores, max-mb, max-vcores)
3. group records with same plugin_instance (to get records for a queue in a bucket)
4. compare if value of allocated-mb > max-mb and allocated-vcore > max-vcore
   and select those records which fulfil all these conditions in a given time period

till now I have managed to bucket the document based on the plugin_instance . Wondering what would be the easy way to compare the documents of each bucket based on the "type_instance"

    GET test/_search
    {
      "query": {
        "query_string": {
          "default_field": "plugin_instance.keyword",
          "query": "root-yarn-queue-name-*"
        }
      },
      "aggs": {
        "byField": {
          "terms": {
            "field": "plugin_instance.keyword"
          }
         
        }
      }
    }