# How to compare the response of elasticsearch query with a list and show final data

**URL:** <https://discuss.elastic.co/t/how-to-compare-the-response-of-elasticsearch-query-with-a-list-and-show-final-data/260353>\
**Category:** Elasticsearch\
**Created:** [January 6, 2021, 2:31pm UTC](https://discuss.elastic.co/t/how-to-compare-the-response-of-elasticsearch-query-with-a-list-and-show-final-data/260353 "2021-01-06T14:31:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![abhinav3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhinav3/32/62151_2.png) [@abhinav3](https://discuss.elastic.co/u/abhinav3)\
**Post date:** [January 6, 2021, 2:31pm UTC](https://discuss.elastic.co/t/how-to-compare-the-response-of-elasticsearch-query-with-a-list-and-show-final-data/260353/1 "2021-01-06T14:31:05Z")

</div>

I some Json data in elasticsearch. This json data has `customer` and `device` in it. I have 2 customer which have multiple devices. I have below query which gives the data for the devices and their customer name:

```auto
{
  "aggs": {
      "device_name": {
          "terms": {
              "field": "Device.keyword"
          },
          "aggs": {
              "top_faq_hits": {
                  "top_hits": {
                      "_source": {
                          "includes": [
                              "Customer"
                          ]
                      },
                      "size": 1
                  }
              }
          }
      }
  }
}

```

This gives me below response which has devices and customer name:

```auto
"aggregations" : {
    "device_name" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "T1",
          "doc_count" : 736,
          "top_faq_hits" : {
            "hits" : {
              "total" : {
                "value" : 736,
                "relation" : "eq"
              },
              "max_score" : 1.0,
              "hits" : [
                {
                  "_index" : "logs",
                  "_type" : "_doc",
                  "_id" : "16",
                  "_score" : 1.0,
                  "_source" : {
                    "Customer" : "Demo1"
                  }
                }
              ]
            }
          }
        },
        {
          "key" : "T2",
          "doc_count" : 237,
          "top_faq_hits" : {
            "hits" : {
              "total" : {
                "value" : 237,
                "relation" : "eq"
              },
              "max_score" : 1.0,
              "hits" : [
                {
                  "_index" : "logs",
                  "_type" : "_doc",
                  "_id" : "73",
                  "_score" : 1.0,
                  "_source" : {
                    "Customer" : "Demo1"
                  }
                }
              ]
            }
          }
        },
        {
          "key" : "T3",
          "doc_count" : 9,
          "top_faq_hits" : {
            "hits" : {
              "total" : {
                "value" : 9,
                "relation" : "eq"
              },
              "max_score" : 1.0,
              "hits" : [
                {
                  "_index" : "logs",
                  "_type" : "_doc",
                  "_id" : "3",
                  "_score" : 1.0,
                  "_source" : {
                    "Customer" : "Demo2"
                  }
                }
              ]
            }
          }
        },
        {
          "key" : "T4",
          "doc_count" : 4,
          "top_faq_hits" : {
            "hits" : {
              "total" : {
                "value" : 4,
                "relation" : "eq"
              },
              "max_score" : 1.0,
              "hits" : [
                {
                  "_index" : "logs",
                  "_type" : "_doc",
                  "_id" : "11",
                  "_score" : 1.0,
                  "_source" : {
                    "Customer" : "Demo2"
                  }
                }
              ]
            }
          }
        }
      ]
    }

```

Looking at above response, I can say that in `Demo1` device `T1, T2` are online and in `Demo2` devices `T3, T4` are online.

I want to write a query which can also give me the offline devices. So for that, is it possible to define a complete list of devices in query so that when the query is executed, it can also compare the response with the list of devices we have mentioned and simply gives us the output of devices which do not matches. This way we can list down the devices which are offline.

So is it possible we can define below json data:

```auto
{
    "Demo1": ["T1", "T2"],
    "Demo2": ["T3", "T4"]
}

```

as a complete list of devices in the query. So lets say if `T2` goes offline and not pushing data for last 15min, in the final output we will get `T2` and customer name `Demo1` . This way we will know, its offline.

Or is there any alternative solution which can tell us the list of devices which are not uploading the data i.e. offline. Can anyone please give some good suggestions on this. Please help. Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 6, 2021, 8:33pm UTC](https://discuss.elastic.co/t/how-to-compare-the-response-of-elasticsearch-query-with-a-list-and-show-final-data/260353/2 "2021-01-06T20:33:21Z")

</div>

Is the assumption that devices are online because they have data in the index?

---

<div class="post-metadata">

**Author:** ![abhinav3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhinav3/32/62151_2.png) [@abhinav3](https://discuss.elastic.co/u/abhinav3)\
**Post date:** [January 7, 2021, 1:20am UTC](https://discuss.elastic.co/t/how-to-compare-the-response-of-elasticsearch-query-with-a-list-and-show-final-data/260353/3 "2021-01-07T01:20:54Z")

</div>

Yes. Lets say for last 15mins, if devices have data that means they are online otherwise offline

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 7, 2021, 2:46am UTC](https://discuss.elastic.co/t/how-to-compare-the-response-of-elasticsearch-query-with-a-list-and-show-final-data/260353/4 "2021-01-07T02:46:07Z")

</div>

You an do that with a Watch via Alerting, eg [https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/lateral\_movement\_in\_user\_comm](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/lateral_movement_in_user_comm) but adapt it to your use case.

There's nothing else within the stack that would do it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 4, 2021, 2:46am UTC](https://discuss.elastic.co/t/how-to-compare-the-response-of-elasticsearch-query-with-a-list-and-show-final-data/260353/5 "2021-02-04T02:46:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.