# Comparing the values of two indices(index1 vs forecast\_index)
**URL:** https://discuss.elastic.co/t/comparing-the-values-of-two-indices-index1-vs-forecast-index/140871
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [July 20, 2018, 10:33am UTC](https://discuss.elastic.co/t/comparing-the-values-of-two-indices-index1-vs-forecast-index/140871 "2018-07-20T10:33:15Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Angelos](https://discuss.elastic.co/u/Angelos)
#### Post date: [July 20, 2018, 10:33am UTC](https://discuss.elastic.co/t/comparing-the-values-of-two-indices-index1-vs-forecast-index/140871/1 "2018-07-20T10:33:15Z")
Hello!
I have created a forecast for a specific product.
So, I want to compare the predicted values(forecast\_index) with real values(index1) and then create an alert using watcher.
How can I return the data from indices in order to compare them in the watcher?
Thank you in advance!
/Angelos
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [July 20, 2018, 3:32pm UTC](https://discuss.elastic.co/t/comparing-the-values-of-two-indices-index1-vs-forecast-index/140871/2 "2018-07-20T15:32:31Z")
Can you be more specific what you mean with comparing? Would two different queries (one for the first index, one for the second) be sufficient or not?
Please take some more time to explain your use-case properly, as it makes it much easier to help.
---
### Author:  [@Angelos](https://discuss.elastic.co/u/Angelos)
#### Post date: [July 23, 2018, 6:57am UTC](https://discuss.elastic.co/t/comparing-the-values-of-two-indices-index1-vs-forecast-index/140871/3 "2018-07-23T06:57:37Z")
Hi Alexander,
For example the index with the real measurements is like this:
"hits": [
{
"\_index": "Index1",
"\_type": "test1",
"\_id": "1",
"\_score": 1,
"\_source": {
"name": "john",
**"product": 6**
}
},
.
.
.
]
So I've made a forecast and the result is like this:
"hits": [
{
"\_index": ".ml-anomalies-shared",
"\_type": "doc",
"\_id": "forecast\_product\_16546143111111",
"\_score": 1,
"\_source": {
"job\_id": "...",
"forecast\_id": "...",
"result\_type": "model\_forecast",
"bucket\_span": ...,
"detector\_index": 0,
"timestamp": 111111111111,
"partition\_field\_name": "...",
"partition\_field\_value": "...",
"model\_feature": "'maximum value by person'",
"forecast\_lower": 6,
"forecast\_upper": 8,
**"forecast\_prediction": 7**
}
},
]
Finally I want to compare the **product** with **forecast\_prediction** and create an alert. If the **forecast\_prediction** is higher than **product** send an email to me.
How can I compare these two measurements in a watcher? Or is there any other way I could do that?
Thank you very much in advance!
/Angelos
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [July 24, 2018, 7:26am UTC](https://discuss.elastic.co/t/comparing-the-values-of-two-indices-index1-vs-forecast-index/140871/4 "2018-07-24T07:26:08Z")
this sounds so far as if you could use a [chain input](https://www.elastic.co/guide/en/elastic-stack-overview/6.3/input-chain.html), that executes two queries and the have a [script condition](https://www.elastic.co/guide/en/elastic-stack-overview/6.3/condition-script.html) that checks if those values are different.
--Alex
---
### Author:  [@Angelos](https://discuss.elastic.co/u/Angelos)
#### Post date: [July 24, 2018, 9:56am UTC](https://discuss.elastic.co/t/comparing-the-values-of-two-indices-index1-vs-forecast-index/140871/5 "2018-07-24T09:56:27Z")
Thank you Alexander!
I just did that but now I have problem on looping through 'hits'. My watcher is like this:
{
"trigger": {
"schedule": {
"interval": "30s"
}
},
"input": {
"chain": {
"inputs": [
{
"first": {
"search": {
"request": {
"search\_type": "query\_then\_fetch",
"indices": [
".ml-anomalies-_"
],
"types": [],
"body": {
"size": 0,
"stored\_fields": [
"_"
],
"script\_fields": {},
"\_source": [
"timestamp",
"partition\_field\_value",
"forecast\_prediction"
],
"query": {
"bool": {
"must": [
{
"match": {
"result\_type": "model\_forecast"
}
},
{
"match": {
"job\_id": "forecast\_product"
}
},
{
"match": {
"partition\_field\_value": "Product1"
}
}
]
}
}
}
}
}
}
},
{
"second": {
"search": {
"request": {
"search\_type": "query\_then\_fetch",
"indices": [
"products\*"
],
"types": [],
"body": {
"size": 0,
"stored\_fields": [
"\*"
],
"script\_fields": {},
"\_source": [
"value-product"
],
"query": {
"bool": {
"must": [
{
"match": {
"product": "Product1"
}
}
]
}
}
}
}
}
}
}
]
}
},
**"condition": {
"script": {
"source": "for (int i = 0; i \< ctx.payload.second.hits.total; ++i) { if (ctx.payload.first.hits.hits[i].\_source.forecast\_prediction \> ctx.payload.second.hits.hits[i].\_source.value-product) { return true;}}",
"lang": "painless"
}
},**
"actions": {
"my-logging-action": {
"logging": {
"level": "warn",
"text": "Logging..."
}
}
}
}
When I simulate I have:
"illegal\_argument\_exception","reason":"Variable [load] is not defined."}},"status":500}"}
So I assume is something wrong with the for loop.
Can you help me?
/Angelos
---
### Author:  [@Angelos](https://discuss.elastic.co/u/Angelos)
#### Post date: [July 24, 2018, 12:36pm UTC](https://discuss.elastic.co/t/comparing-the-values-of-two-indices-index1-vs-forecast-index/140871/6 "2018-07-24T12:36:24Z")
Hello!
I think I found the problem. In my index the the product value is written like this "value-product". So in if statement the "dash" cannot be read.
Is there any way to solve this issue with the dash "-" in order to read the "ctx.payload.second.hits.hits[i].\_source.value-product"?
/Angelos
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [July 25, 2018, 7:32am UTC](https://discuss.elastic.co/t/comparing-the-values-of-two-indices-index1-vs-forecast-index/140871/7 "2018-07-25T07:32:27Z")
try `ctx.payload.second.hits.hits[i]._source["value-product"]`
You may want to rehink if it is feasible to compare each hit of one index with each hit of the other index. This will not work if one index has millions of items (which might not be a concern in your use-case, just something to keep in mind).
---
### Author:  [@Angelos](https://discuss.elastic.co/u/Angelos)
#### Post date: [July 25, 2018, 8:04am UTC](https://discuss.elastic.co/t/comparing-the-values-of-two-indices-index1-vs-forecast-index/140871/8 "2018-07-25T08:04:57Z")
It works fine! I had to modified it a bit like this:
ctx.payload.second.hits.hits[i].\_source[**'value-product'**]
Thank you very much Alex!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 22, 2018, 8:04am UTC](https://discuss.elastic.co/t/comparing-the-values-of-two-indices-index1-vs-forecast-index/140871/9 "2018-08-22T08:04:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.