How to compare the value of two fields?


#1

Hi!

I have two kinds of logs in ES (rtmp and apache), apache has clientip.raw and rtmp has ipclient.raw. The problem is: how can I see in my Kibana panel just the data that has this condition "ipclient=clientip" ?

I tried writing this in my search bar, but doesn´t work:

{
    "query": {
        "filtered": {
            "filter": {
                "script": {
                    "script": "doc['clientip.raw'].value == doc['ipclient.raw'].value"
                }
            }
        }
    } 
}

Thanks in advance.


(system) #2