# Kibana: find IP addresses that are in two different indexes

**URL:** https://discuss.elastic.co/t/kibana-find-ip-addresses-that-are-in-two-different-indexes/237889
**Category:** Kibana
**Created:** [June 20, 2020, 12:29am UTC](https://discuss.elastic.co/t/kibana-find-ip-addresses-that-are-in-two-different-indexes/237889 "2020-06-20T00:29:28Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![stcdarrell](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)
#### Post date: [June 20, 2020, 12:29am UTC](https://discuss.elastic.co/t/kibana-find-ip-addresses-that-are-in-two-different-indexes/237889/1 "2020-06-20T00:29:28Z")

</div>

hi, i'm having trouble wrapping my head around the best way to query kibana. I have indexes lets just say:  
Index-Business1-firewall-Logs  
Index-Business2-filewall-Logs

i have a kibana Index Pattern that is Index-Business\*, so both businesses firewall data is displayed  
i have fields for source and destination IP's. [source][ip] and [destination][ip]

i need a query to find what destination ips are in BOTH indexes.

basically:  
[destination][ip]:\* AND (\_index: Index-Business1-firewall-Logs AND Index-Business2-firewall-Logs)

but that doesnt seem to work.. any suggestions?

to make it even fancier.. i'd love to limit the source address to an internal address and do the same search.. so:  
([source][ip]: 172._) AND [destination][ip]:_ AND (\_index: Index-Business1-firewall-Logs AND Index-Business2-firewall-Logs)

thank you  
Darrell

---

<div class="post-metadata">

### Author: ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)
#### Post date: [June 25, 2020, 1:46am UTC](https://discuss.elastic.co/t/kibana-find-ip-addresses-that-are-in-two-different-indexes/237889/2 "2020-06-25T01:46:47Z")

</div>

If you have an index pattern that covers multiple indices then something like `destination.ip : *`

If you're still having trouble it might be helpful to show a screenshot of the searchbar.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 23, 2020, 1:46am UTC](https://discuss.elastic.co/t/kibana-find-ip-addresses-that-are-in-two-different-indexes/237889/3 "2020-07-23T01:46:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.