# Condition compare - aggregations
**URL:** https://discuss.elastic.co/t/condition-compare-aggregations/154702
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [October 30, 2018, 5:48pm UTC](https://discuss.elastic.co/t/condition-compare-aggregations/154702 "2018-10-30T17:48:19Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Amanda](https://discuss.elastic.co/u/Amanda)
#### Post date: [October 30, 2018, 5:48pm UTC](https://discuss.elastic.co/t/condition-compare-aggregations/154702/1 "2018-10-30T17:48:19Z")
Can we compare two different aggregations when using condition - compare struct?
Example:
"condition": {
"compare" : { "ctx.payload.aggregations.top\_number1.buckets" : { "eq" : "{{ctx.payload.aggregations.top\_number2.buckets}}" }}
}
I'm trying to construct a watcher that will compare two fields and if they have the same value, this value will be returned.
---
### Author:  [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)
#### Post date: [October 30, 2018, 8:59pm UTC](https://discuss.elastic.co/t/condition-compare-aggregations/154702/2 "2018-10-30T20:59:23Z")
Hey @Amanda, you can per [Compare condition | Elasticsearch Guide [6.4] | Elastic](https://www.elastic.co/guide/en/elastic-stack-overview/6.4/condition-compare.html#_using_a_compare_condition)
> You can also compare two values in the execution context by specifying the compared value as a path of the form of `{{path}}` . For example, the following condition compares the `ctx.payload.aggregations.status.buckets.error.doc_count` to the `ctx.payload.aggregations.handled.buckets.true.doc_count` :
```auto
{
"condition" : {
"compare" : {
"ctx.payload.aggregations.status.buckets.error.doc_count" : {
"not_eq" : "{{ctx.payload.aggregations.handled.buckets.true.doc_count}}"
}
}
}
```
---
### Author:  [@Amanda](https://discuss.elastic.co/u/Amanda)
#### Post date: [November 1, 2018, 5:25pm UTC](https://discuss.elastic.co/t/condition-compare-aggregations/154702/3 "2018-11-01T17:25:41Z")
Hi @Brandon_Kobel,
Can you help me with this? I think I'm doing something wrong cause my condition compare is not returning any result.
Here is a sample of what I've done, for now it is just a test.
```auto
{
"trigger": {
"schedule": {
"daily": {
"at": [
"09:00"
]
}
}
},
"input": {
"chain": {
"inputs": [
{
"first": {
"search": {
"request": {
"indices": [
"index-*"
],
"body": {
"query": {
"bool": {
"filter": [
{
"query_string": {
"query": "host:localhost AND _exists_:port",
"analyze_wildcard": true
}
},
{
"range": {
"@timestamp": {
"gte": "now-1d",
"lt": "now"
}
}
}
]
}
},
"aggs": {
"local": {
"terms": {
"field": "port",
"size": 10
}
}
}
}
}
}
}
},
{
"second": {
"search": {
"request": {
"indices": [
"index-*"
],
"body": {
"query": {
"bool": {
"filter": [
{
"query_string": {
"query": "host:tbc AND _exists_:port",
"analyze_wildcard": true
}
},
{
"range": {
"@timestamp": {
"gte": "now-1d",
"lt": "now"
}
}
}
]
}
},
"aggs": {
"tbc1": {
"terms": {
"field": "port",
"size": 10
}
}
}
}
}
}
}
}
]
}
},
"condition": {
"compare": {
"ctx.payload.hit.aggregations.local.buckets.key": {
"eq": "{{ctx.payload.aggregations.tbc1.buckets.key}}"
}
}
},
"actions": {
"log": {
"logging": {
"text": "they are equal!"
}
}
}
}
```
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [November 2, 2018, 9:12am UTC](https://discuss.elastic.co/t/condition-compare-aggregations/154702/4 "2018-11-02T09:12:09Z")
Hey,
It's much better to ditch the `compare` condition here and go with the `script` condition if you want to compare to response values of the a search input.
Also note that the paths you are referring to, do not match with your configured chain input. The names of the the inputs are `first` and `second` respectively, which can be anything, but those names need to be used to refer to them.
In addition, the output of an aggregation includes an `array` of buckets, so you cannot directly address the keys. The example below checks if the first two buckets are equal - this may or may not be what you are after.
```auto
"script": {
"source" : "return ctx.payload.first.aggregations.local.buckets[0].key == ctx.payload.second.aggregations.tbc1.buckets[0].key"
}
```
If you take a step back and explain your use case a bit more detailed (without any mention of Elasticsearch, just the problem you are trying to solve), we might come with a completely different solution than this one, as I am not sure it fits every case (like comparing only the first output of the aggregation buckets).
Hope this helps!
---
### Author:  [@Amanda](https://discuss.elastic.co/u/Amanda)
#### Post date: [November 12, 2018, 3:13pm UTC](https://discuss.elastic.co/t/condition-compare-aggregations/154702/5 "2018-11-12T15:13:41Z")
Hi,
I have only one index and i want to compare two fields value and get the result, they are the same fields but may have different values from different requests.
I wanna compare them and check if they have the same value, I would receive an e-mail showing me the requests.
For example: If the values of the field host are the same, then a message would be logged
Index: index-\*
fields: 1. host:star
2. port:1221
Index: index-\*
fields: 1. host:star
2. port:3697
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 10, 2018, 3:13pm UTC](https://discuss.elastic.co/t/condition-compare-aggregations/154702/6 "2018-12-10T15:13:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.