Create field associated by query

I have this Ip address "" in the "ip" field and I do the search ip:, then add to that search a field called blacklist, and so associate blacklist to all the addresses that I want.

And create a visualization with IP and blacklist as fields.

Is this possible?

I have ES 6.8

Thank you for all your support.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.