# How to compare two aggregations buckets in watcher **URL:** https://discuss.elastic.co/t/how-to-compare-two-aggregations-buckets-in-watcher/135640 **Category:** Elasticsearch **Tags:** elastic-stack-alerting **Created:** [June 13, 2018, 6:58am UTC](https://discuss.elastic.co/t/how-to-compare-two-aggregations-buckets-in-watcher/135640 "2018-06-13T06:58:18Z") **Posts on this page:** 1 **Showing post:** 2
### Author: ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier) #### Post date: [June 13, 2018, 3:06pm UTC](https://discuss.elastic.co/t/how-to-compare-two-aggregations-buckets-in-watcher/135640/2 "2018-06-13T15:06:38Z")
Anuj, I've already recommended in [a different thread](https://discuss.elastic.co/t/how-to-compare-two-different-fields-value-of-two-different-index/132533/11) that you should look at this post for ideas: > [@Comparing values from 2 ML Jobs in watcher](https://discuss.elastic.co/t/comparing-values-from-2-ml-jobs-in-watcher/118882): > > Hi, I have 2 different ML jobs. Identifies the anomaly in the users unusual login time. IE if users regularly logs in between 11:00 AM - 6:00 PM and one day he/she logs in @ 12:00 AM. this will be detected as a anomaly. Detect longitude-latitude usually used by a person, if a person usually logs in fro 11.222, -11.33 (example) and suddenly logs in from 13.22, -34,55. this will be detected as anomaly. This 2 job independently works fine. I need to write a watcher over these 2 job which … Why do you keep on asking? I'm confused... --- _[View the full topic](https://discuss.elastic.co/t/how-to-compare-two-aggregations-buckets-in-watcher/135640)._