# Correlation between different fields of different logs - Question **URL:** \ **Category:** Elasticsearch\ **Created:** [February 21, 2018, 7:03pm UTC](https://discuss.elastic.co/t/correlation-between-different-fields-of-different-logs-question/120921 "2018-02-21T19:03:30Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![NGCyber](https://avatars.discourse-cdn.com/v4/letter/n/9f8e36/32.png) [@NGCyber](https://discuss.elastic.co/u/NGCyber)\ **Post date:** [February 21, 2018, 7:03pm UTC](https://discuss.elastic.co/t/correlation-between-different-fields-of-different-logs-question/120921/1 "2018-02-21T19:03:30Z")
Hi, I am trying to find a solution to this problem, and I can't seem to find the solution for quite some time. I am new to ELK, and I hoped someone can help me somehow. Let's say I have an ELK which receives logs through filebeat from many sources. Among the sources, there are A and B. A has a field which is named LOGED\_DNS, and B has a field which is named GOOD\_DNS. I want to be able to run a search/script/(something else) which would tell me if there are any LOGED\_DNS from logs of source A which are the same as any GOOD\_DNS of source B. Example: @timestamp: ... , ... , ... , source: A, LOGED\_DNS: [qwerty.com](http://qwerty.com), ..., ... @timestamp: ... , ... , ... , source: B, GOOD\_DNS: [qwerty.com](http://qwerty.com), ..., ... These should be searched/alarmed somehow. I found many solutions on the web which consists of comparing fields of the same log, but not comparing between two different ones. Thank you very much in advance. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 21, 2018, 7:03pm UTC](https://discuss.elastic.co/t/correlation-between-different-fields-of-different-logs-question/120921/2 "2018-03-21T19:03:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.