Kibana: find IP addresses that are in two different indexes

Elastic Stack Kibana
1

hi, i'm having trouble wrapping my head around the best way to query kibana. I have indexes lets just say:
Index-Business1-firewall-Logs
Index-Business2-filewall-Logs

i have a kibana Index Pattern that is Index-Business*, so both businesses firewall data is displayed
i have fields for source and destination IP's. [source][ip] and [destination][ip]

i need a query to find what destination ips are in BOTH indexes.

basically:
[destination][ip]:* AND (_index: Index-Business1-firewall-Logs AND Index-Business2-firewall-Logs)

but that doesnt seem to work.. any suggestions?

to make it even fancier.. i'd love to limit the source address to an internal address and do the same search.. so:
([source][ip]: 172.) AND [destination][ip]: AND (_index: Index-Business1-firewall-Logs AND Index-Business2-firewall-Logs)

thank you
Darrell

2

If you have an index pattern that covers multiple indices then something like destination.ip : *

If you're still having trouble it might be helpful to show a screenshot of the searchbar.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.