# Kibana Vlookup Equivalent

**URL:** <https://discuss.elastic.co/t/kibana-vlookup-equivalent/293640>\
**Category:** Kibana\
**Created:** [January 6, 2022, 11:08am UTC](https://discuss.elastic.co/t/kibana-vlookup-equivalent/293640 "2022-01-06T11:08:17Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sandeep\_Raju](https://avatars.discourse-cdn.com/v4/letter/s/8797f3/32.png) [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\
**Post date:** [January 6, 2022, 11:08am UTC](https://discuss.elastic.co/t/kibana-vlookup-equivalent/293640/1 "2022-01-06T11:08:17Z")

</div>

Hi all,

I have 2 indices in an index pattern.  
I want to see what are the documents which have the same fields values in both indices.  
Basically like vlookup in excel.

I've tried a scripted field, but not getting approach of comparing and getting values from other document.

Any hint?

---

<div class="post-metadata">

**Author:** ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)\
**Post date:** [January 6, 2022, 2:51pm UTC](https://discuss.elastic.co/t/kibana-vlookup-equivalent/293640/2 "2022-01-06T14:51:46Z")

</div>

Hi @Sandeep_Raju. Can you show an example of the documents you are trying to compare? Also can you show an example of the scripted field you tried?

---

<div class="post-metadata">

**Author:** ![ghudgins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghudgins/32/138532_2.png) [@ghudgins](https://discuss.elastic.co/u/ghudgins)\
**Post date:** [January 6, 2022, 7:00pm UTC](https://discuss.elastic.co/t/kibana-vlookup-equivalent/293640/3 "2022-01-06T19:00:22Z")

</div>

Another idea - to do this sort of VLOOKUP (database lookup join) is to enrich the data as it comes in (as it's indexed) or enrich the data after the fact by updating those documents.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 9, 2022, 9:59pm UTC](https://discuss.elastic.co/t/kibana-vlookup-equivalent/293640/4 "2022-01-09T21:59:28Z")

</div>

Graham's comments are how we usually approach this in our stack.

---

<div class="post-metadata">

**Author:** ![Sandeep\_Raju](https://avatars.discourse-cdn.com/v4/letter/s/8797f3/32.png) [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\
**Post date:** [January 10, 2022, 4:24am UTC](https://discuss.elastic.co/t/kibana-vlookup-equivalent/293640/5 "2022-01-10T04:24:20Z")

</div>

Enrich processor works in Elasticsearch, but i'm using Opendistro.  
It doesn't work in Opendistro.  
Any ideas for Opendistro?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 10, 2022, 4:25am UTC](https://discuss.elastic.co/t/kibana-vlookup-equivalent/293640/6 "2022-01-10T04:25:07Z")

</div>

You'd need to ask aws, as it's their product.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 7, 2022, 4:25am UTC](https://discuss.elastic.co/t/kibana-vlookup-equivalent/293640/7 "2022-02-07T04:25:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.