# Kibana search events where value of a field matches another fields value in the same event?

**URL:** <https://discuss.elastic.co/t/kibana-search-events-where-value-of-a-field-matches-another-fields-value-in-the-same-event/287074>\
**Category:** Kibana\
**Tags:** kql-kibana-query-language\
**Created:** [October 19, 2021, 10:44am UTC](https://discuss.elastic.co/t/kibana-search-events-where-value-of-a-field-matches-another-fields-value-in-the-same-event/287074 "2021-10-19T10:44:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![buzzdeee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/buzzdeee/32/12703_2.png) [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\
**Post date:** [October 19, 2021, 10:44am UTC](https://discuss.elastic.co/t/kibana-search-events-where-value-of-a-field-matches-another-fields-value-in-the-same-event/287074/1 "2021-10-19T10:44:14Z")

</div>

Hi,

is it somehow possible to search in kibana either via KQL or Lucene syntax for a field that has the same value as another field in the same event?  
i.e. assume I've a user.name and user.target.name where some events may contain the same value, i.e. a user did something to himself.

i.e. I can search for:

`user.name: foobar and user.target.name: foobar`

but that would require me, to already know the value I'm looking for.

so in a search, I want to find all events where any user did something to himself instead of to some other users. So can I somehow reference a field for it's value and search for that?

somehow alike:

`user.name: $user.target.name`

I tried to find something like that in the docs, but was unable to find.

hope that's somehow possible.

Sebastian

---

<div class="post-metadata">

**Author:** ![Marco\_Liberati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marco_liberati/32/82953_2.png) [@Marco\_Liberati](https://discuss.elastic.co/u/Marco_Liberati)\
**Post date:** [October 20, 2021, 8:27am UTC](https://discuss.elastic.co/t/kibana-search-events-where-value-of-a-field-matches-another-fields-value-in-the-same-event/287074/2 "2021-10-20T08:27:48Z")

</div>

Hi @buzzdeee

I think you're best bet in this case is to use `runtime fields`: create a field C where you check that the value of field A and B are the same string/value and return a boolean value.  
Then you can run the queries based on field C.

> **[Runtime fields | Elasticsearch Guide \[master\] | Elastic](https://www.elastic.co/guide/en/elasticsearch//reference/master/runtime.html)**

I created an example here with the flight data sample, when a new `runtime field` `sameGeo` returns true if both `OriginCountry` and `DestCountry` contain the same value (country string):

 ![Screenshot 2021-10-20 at 10.23.55](https://us1.discourse-cdn.com/elastic/original/3X/9/0/909bd2ecdc3633843d590c5f40783803081e5f58.png)

Would that work for you?

---

<div class="post-metadata">

**Author:** ![buzzdeee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/buzzdeee/32/12703_2.png) [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\
**Post date:** [October 20, 2021, 11:13am UTC](https://discuss.elastic.co/t/kibana-search-events-where-value-of-a-field-matches-another-fields-value-in-the-same-event/287074/3 "2021-10-20T11:13:16Z")

</div>

Hi @Marco_Liberati

runtime fields are awesome, never used before, only know about their existence.

I ended up with the following, operating on the winlogbeat-\* index pattern. That seems to exactly do what I want, and I can Discover the field, and do what I want:

```auto
if (doc['user.name'].size() > 0 && doc['winlog.event_data.TargetUserName'].size() > 0) { 
	def sameUser = doc['user.name'].value == doc['winlog.event_data.TargetUserName'].value;
    if (sameUser) {
        emit(sameUser)
    }
}

```

thanks a lot,  
Sebastian

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 17, 2021, 11:14am UTC](https://discuss.elastic.co/t/kibana-search-events-where-value-of-a-field-matches-another-fields-value-in-the-same-event/287074/4 "2021-11-17T11:14:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.