# Create Alert by Comparing 2 fields in 2 indexes

**URL:** <https://discuss.elastic.co/t/create-alert-by-comparing-2-fields-in-2-indexes/284694>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [September 21, 2021, 8:58am UTC](https://discuss.elastic.co/t/create-alert-by-comparing-2-fields-in-2-indexes/284694 "2021-09-21T08:58:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abanob\_Medhat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abanob_medhat/32/92528_2.png) [@Abanob\_Medhat](https://discuss.elastic.co/u/Abanob_Medhat)\
**Post date:** [September 21, 2021, 8:58am UTC](https://discuss.elastic.co/t/create-alert-by-comparing-2-fields-in-2-indexes/284694/1 "2021-09-21T08:58:56Z")

</div>

Hi,  
I want to compare 2 fields from 2 different indexes to create alert.  
the 2 indexes , one for apache access logs and the other one is my IOCs.  
All what I want to do is to compare between the vulnerable IPs in my IOCs with the apache logs and if there is any match, I want to create alert .  
so, can anyone help me?

---

<div class="post-metadata">

**Author:** ![dosant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dosant/32/64489_2.png) [@dosant](https://discuss.elastic.co/u/dosant)\
**Post date:** [October 1, 2021, 10:05am UTC](https://discuss.elastic.co/t/create-alert-by-comparing-2-fields-in-2-indexes/284694/2 "2021-10-01T10:05:52Z")

</div>

Doesn't look like there is a way to compare between two indices.

This is less then ideal, but I guess you could create an Elasticsearch query rule and put your known ips into the query. Then you could automate updating the rule with the new ips via alerting rest API.

---

<div class="post-metadata">

**Author:** ![Abanob\_Medhat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abanob_medhat/32/92528_2.png) [@Abanob\_Medhat](https://discuss.elastic.co/u/Abanob_Medhat)\
**Post date:** [October 3, 2021, 10:23am UTC](https://discuss.elastic.co/t/create-alert-by-comparing-2-fields-in-2-indexes/284694/3 "2021-10-03T10:23:19Z")

</div>

Thanks, It worked for me.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2021, 10:24am UTC](https://discuss.elastic.co/t/create-alert-by-comparing-2-fields-in-2-indexes/284694/4 "2021-10-31T10:24:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.