# Elasticsearch - return result if we have 80% overlap

**URL:** <https://discuss.elastic.co/t/elasticsearch-return-result-if-we-have-80-overlap/197857>\
**Category:** Elasticsearch\
**Created:** [September 3, 2019, 12:37pm UTC](https://discuss.elastic.co/t/elasticsearch-return-result-if-we-have-80-overlap/197857 "2019-09-03T12:37:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)\
**Post date:** [September 3, 2019, 12:37pm UTC](https://discuss.elastic.co/t/elasticsearch-return-result-if-we-have-80-overlap/197857/1 "2019-09-03T12:37:10Z")

</div>

Hello.

I am trying to implement a data lookups using Logstash against some threat intelligence database from flowing proxy logs.

Basically I am loading documents to ES containing malicious URLs. Then, during the log processing, I am checking if the URL in logs is matching 1:1 with the ES Threat Intelligence db.

However, I would like to get also the results from the URLs that are matching 80%.  
When loading the data to the threat intelligence index I am using:

> ```
> "analysis": {
> 
> ```
> 
> "filter": {  
> "my\_ngram\_filter": {  
> "type": "ngram",  
> "min\_gram": 3,  
> "max\_gram": 4  
> }  
> },  
> "analyzer": {  
> "my\_ngram\_analyzer": {  
> "type": "custom",  
> "tokenizer": "standard",  
> "filter": [  
> "lowercase",  
> "my\_ngram\_filter"  
> ]  
> }  
> }  
> }  
> "properties": {  
> "parameters": {  
> "type": "text",  
> "fields": {  
> "ngrammed": {  
> "type": "text",  
> "analyzer": "my\_ngram\_analyzer",  
> "search\_analyzer": "my\_ngram\_analyzer"  
> }  
> }  
> }  
> }

and later I am querying:

> {  
> "size": 2,  
> "query": {  
> "bool": {  
> "should": [  
> {  
> "match": {  
> "fqdn": "[s3-us-west-2.amazonaws.com](http://s3-us-west-2.amazonaws.com)"  
> }  
> },  
> {  
> "match": {  
> "parameters.ngrammed": "somepath/malware.exe"  
> }  
> }  
> ],  
> "minimum\_should\_match" : 2,  
> "boost": 2.0  
> }  
> }  
> }

But I do not know how to accomplish the 80% overlap.  
I am open for any suggestion.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2019, 12:37pm UTC](https://discuss.elastic.co/t/elasticsearch-return-result-if-we-have-80-overlap/197857/2 "2019-10-01T12:37:21Z")

</div>

Closed on October 1, 2019, 12:37pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.