# Match field A in index A against field B in index B

**URL:** <https://discuss.elastic.co/t/match-field-a-in-index-a-against-field-b-in-index-b/54673>\
**Category:** Elasticsearch\
**Created:** [July 4, 2016, 5:55pm UTC](https://discuss.elastic.co/t/match-field-a-in-index-a-against-field-b-in-index-b/54673 "2016-07-04T17:55:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Geezer](https://avatars.discourse-cdn.com/v4/letter/g/49beb7/32.png) [@Geezer](https://discuss.elastic.co/u/Geezer)\
**Post date:** [July 4, 2016, 5:55pm UTC](https://discuss.elastic.co/t/match-field-a-in-index-a-against-field-b-in-index-b/54673/1 "2016-07-04T17:55:59Z")

</div>

Hello,

I have DNS query data from Packetbeat written to one index and will import a list of bad domains to a second index.

How can I perform a search to find where field A from index A matches field B from index B, to see which endpoint is looking up bad domains?

Thank you.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 4, 2016, 9:14pm UTC](https://discuss.elastic.co/t/match-field-a-in-index-a-against-field-b-in-index-b/54673/2 "2016-07-04T21:14:15Z")

</div>

That is a join, which you cannot do in ES.

---

<div class="post-metadata">

**Author:** ![Geezer](https://avatars.discourse-cdn.com/v4/letter/g/49beb7/32.png) [@Geezer](https://discuss.elastic.co/u/Geezer)\
**Post date:** [July 5, 2016, 3:06pm UTC](https://discuss.elastic.co/t/match-field-a-in-index-a-against-field-b-in-index-b/54673/3 "2016-07-05T15:06:02Z")

</div>

Understood, thank you. I'll try this with Siren Join.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:37pm UTC](https://discuss.elastic.co/t/match-field-a-in-index-a-against-field-b-in-index-b/54673/4 "2017-07-05T22:37:54Z")

</div>