# Diff out all documents with the same hash key in 2 (or more) test runs

**URL:** https://discuss.elastic.co/t/diff-out-all-documents-with-the-same-hash-key-in-2-or-more-test-runs/105124
**Category:** Elasticsearch
**Created:** [October 24, 2017, 8:38pm UTC](https://discuss.elastic.co/t/diff-out-all-documents-with-the-same-hash-key-in-2-or-more-test-runs/105124 "2017-10-24T20:38:57Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Siegfried\_Hauenstein](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@Siegfried\_Hauenstein](https://discuss.elastic.co/u/Siegfried_Hauenstein)
#### Post date: [October 24, 2017, 8:38pm UTC](https://discuss.elastic.co/t/diff-out-all-documents-with-the-same-hash-key-in-2-or-more-test-runs/105124/1 "2017-10-24T20:38:57Z")

</div>

Hi Folks,

I am pretty new to elastic search pattern and wonder if you can give me any hint if this is possible what I want.

- I collect system logs over daily regression tests.

- I generate a normalized hash key for every syslog payload which does not contain any dynamic number.

- I tag all syslog traces with a "run" tag. Lets say "run1" and "run2"

Now I want to find the "difference" between the 2 runs and visualize it in kibana.

My pseudo filter code looks like:

filter out all elements with:  
( document.hash (document.version) == document.hash(document.versionB) )

Is this possible with a filter rule?

Any hint is appreciated.

Kind regards  
Siggi

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 21, 2017, 8:41pm UTC](https://discuss.elastic.co/t/diff-out-all-documents-with-the-same-hash-key-in-2-or-more-test-runs/105124/2 "2017-11-21T20:41:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
