# I want to search the index for the same value as the document in another index

**URL:** <https://discuss.elastic.co/t/i-want-to-search-the-index-for-the-same-value-as-the-document-in-another-index/208648>\
**Category:** Elasticsearch\
**Created:** [November 20, 2019, 8:04am UTC](https://discuss.elastic.co/t/i-want-to-search-the-index-for-the-same-value-as-the-document-in-another-index/208648 "2019-11-20T08:04:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kobaya](https://avatars.discourse-cdn.com/v4/letter/k/f1d935/32.png) [@kobaya](https://discuss.elastic.co/u/kobaya)\
**Post date:** [November 20, 2019, 8:04am UTC](https://discuss.elastic.co/t/i-want-to-search-the-index-for-the-same-value-as-the-document-in-another-index/208648/1 "2019-11-20T08:04:27Z")

</div>

Hello.  
I put a proxy log in the elasticsearch index.  
Next, I made an index with blacklist addresses.  
Is it possible to search addresses in the blacklist index from the proxy log index?

Thank you.  
kobaya

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [November 20, 2019, 9:02am UTC](https://discuss.elastic.co/t/i-want-to-search-the-index-for-the-same-value-as-the-document-in-another-index/208648/2 "2019-11-20T09:02:51Z")

</div>

If your blacklist is small then it is most efficient to write a loop in your client that reads the addresses and issues searches. Multiple addresses can be grouped using a `terms` query for more efficient querying.  
If your blacklist is large then it may be faster to compare two sorted streams of information rather than doing lots of searches (random disk seeks are expensive). This can be done using something like the composite aggregation with the after parameter:

```
GET testproxy,testblacklist/_search
{
  "size":0,
  "aggs": {
	"joined": {
	  "composite": {
		"sources": [
		  {
			"address": {
			  "terms": {
				"field": "address",
				"order": "asc"
			  }
			}
		  }
		]
	  },
	  "aggs": {
		"numIndices": {
		  "cardinality": {
			"field": "_index"
		  }
		}
	  }
	}
  }
}

```

The disadvantage with composite is that you can't trim the JSON of addresses that only got a hit on one of the indices.  
Alternatively, you could use the `terms` aggregation with partitioning and sort the addresses by the number of matched indices to help trim the non-interesting addresses from the results. This [wizard](https://plnkr.co/edit/4u5CscRfiUOQwUDSDRgC?p=preview) might help with some of the join choices.

---

<div class="post-metadata">

**Author:** ![kobaya](https://avatars.discourse-cdn.com/v4/letter/k/f1d935/32.png) [@kobaya](https://discuss.elastic.co/u/kobaya)\
**Post date:** [November 26, 2019, 4:26am UTC](https://discuss.elastic.co/t/i-want-to-search-the-index-for-the-same-value-as-the-document-in-another-index/208648/3 "2019-11-26T04:26:39Z")

</div>

Hi Mark\_Harwood,

Thanks for the reply.  
I would like to try what you taught me.

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 24, 2019, 4:26am UTC](https://discuss.elastic.co/t/i-want-to-search-the-index-for-the-same-value-as-the-document-in-another-index/208648/4 "2019-12-24T04:26:43Z")

</div>

Closed on December 24, 2019, 4:26am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.