# Field search using Logstash configuration

**URL:** <https://discuss.elastic.co/t/field-search-using-logstash-configuration/276259>\
**Category:** Logstash\
**Created:** [June 17, 2021, 11:41am UTC](https://discuss.elastic.co/t/field-search-using-logstash-configuration/276259 "2021-06-17T11:41:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pallavibhushan](https://avatars.discourse-cdn.com/v4/letter/p/13edae/32.png) [@Pallavibhushan](https://discuss.elastic.co/u/Pallavibhushan)\
**Post date:** [June 17, 2021, 11:41am UTC](https://discuss.elastic.co/t/field-search-using-logstash-configuration/276259/1 "2021-06-17T11:41:10Z")

</div>

Hi ,  
Below is my requirement.  
I have two indexes

1. Index : Client\_one [fields : employee\_no1,salary, exp]
2. Index: client\_two. [fields " employee\_no2, total\_exp]

Both index have one common field employee\_no.  
I want to sync if employee no1(from client\_one index) == employee\_no2(from client\_two index) then insert salary in client\_two index.

how to achieve this using logstash config.

I tried below but doesn't work as expected.

> Blockquote

```auto
input {
       elasticsearch 
	   {
			hosts => ["http://localhost:9200/"]
			index => "client_one"
			query => '{ "query": { "match_all": { } }, "sort": ["_doc"] }'
			docinfo => true
	   }
}
filter 
{
	
		mutate
		{
			copy => { "employee_no1" => "emp_number" } 
		}
	elasticsearch 
	{
 
		hosts => ["http://localhost:9200/"]
		index => "client_two"
		
		fields => {
       	"employee_no2" => "emp_num"
        "salary" => "salary_new"
		
     }
	}
		
	if([emp_number]== [emp_num])
	{
		mutate 
		{
			add_field => ["total_sal", "%{[salary_new]}" ]
		}
	} 
}  
output { 
			stdout {}  
			stdout {codec => rubydebug}
		    elasticsearch {
							index => "client_two"
							hosts => ["http://localhost:9200/"]
				            #action => "create"
																										
					} 
}  

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 15, 2021, 11:41am UTC](https://discuss.elastic.co/t/field-search-using-logstash-configuration/276259/2 "2021-07-15T11:41:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.