# Not able to compare two loops in a chain query
**URL:** https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [June 12, 2018, 8:57am UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488 "2018-06-12T08:57:33Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@addanuj](https://discuss.elastic.co/u/addanuj)
#### Post date: [June 12, 2018, 8:57am UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488/1 "2018-06-12T08:57:33Z")
Hi i am trying to achieve below
I have two different index and i want to compare two fields values using loop and get result if any of the IP address value matches
for example :-
Index 1: threatintel
fields :- 1. indicator\_ip
2. message
3. userid
Index 2: checkpoint
fields:- 1. srcip
2. dstip
using below watch condition i am only able to check only first value, how to use a loop to check all values
```
"condition": {
"compare": {
"ctx.payload.first.hits.hits.0._source.srcip": {
"eq": "{{ctx.payload.second.hits.hits.0._source.indicator-ip}}"
}
}
},
```
@richcollier Please help
---
### Author:  [@addanuj](https://discuss.elastic.co/u/addanuj)
#### Post date: [June 12, 2018, 8:59am UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488/2 "2018-06-12T08:59:23Z")
First Chain Query
```
{
"watch":
{
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"chain": {
"inputs": [
{
"first": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"logstash-checkpoint*"
],
"types": [],
"body": {
"aggs": {
"time": {
"terms": {
"field": "@timestamp",
"order": {
"_count": "desc"
}
},
"aggs": {
"srcip": {
"terms": {
"field": "srcip.keyword",
"order": {
"_count": "desc"
}
},
"aggs": {
"dstip": {
"terms": {
"field": "dstip.keyword",
"order": {
"_count": "desc"
}
}
}
}
}
}
}
},
"version": true,
"_source": {
"excludes": []
},
"stored_fields": [
"*"
],
"script_fields": {},
"docvalue_fields": [
"@timestamp"
],
"query": {
"bool": {
"must": [
{
"match_all": {}
},
{
"match_all": {}
},
{
"exists": {
"field": "srcip.keyword"
}
},
{
"exists": {
"field": "dstip.keyword"
}
},
{
"range": {
"@timestamp": {
"gte": "{{ctx.trigger.scheduled_time}}||-1d",
"lte": "{{ctx.trigger.scheduled_time}}",
"format": "strict_date_optional_time||epoch_millis"
}
}
}
],
"filter": [],
"should": [],
"must_not": []
}
}
}
}
}
}
},
```
---
### Author:  [@addanuj](https://discuss.elastic.co/u/addanuj)
#### Post date: [June 12, 2018, 9:02am UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488/3 "2018-06-12T09:02:35Z")
```
Second Chain Query
{
"second": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"logstash-security-*"
],
"types": [],
"body": {
"aggs": {
"time": {
"terms": {
"field": "@timestamp",
"size": 5,
"order": {
"_count": "desc"
}
},
"aggs": {
"indicator": {
"terms": {
"field": "indicator.keyword",
"size": 5,
"order": {
"_count": "desc"
}
}
}
}
}
},
"version": true,
"_source": {
"excludes": []
},
"stored_fields": [
"*"
],
"script_fields": {},
"docvalue_fields": [
"@timestamp",
"security_log.time"
],
"query": {
"bool": {
"must": [
{
"match_all": {}
},
{
"match_all": {}
},
{
"bool": {
"should": [
{
"match_phrase": {
"type.keyword": "threatintel"
}
}
],
"minimum_should_match": 1
}
},
{
"match_phrase": {
"indicator_parent": {
"query": "ip"
}
}
},
{
"exists": {
"field": "indicator"
}
},
{
"range": {
"@timestamp": {
"gte": "{{ctx.trigger.scheduled_time}}||-1d",
"lte": "{{ctx.trigger.scheduled_time}}",
"format": "strict_date_optional_time||epoch_millis"
}
}
}
],
"filter": [],
"should": [],
"must_not": []
}
}
}
}
}
}
}
]
}
},
"condition": {
"compare": {
?????????????
},
"actions": {
"log": {
"logging": {
"level": "info",
"text": "what condition should i write"
}
}
}
}
```
---
### Author:  [@addanuj](https://discuss.elastic.co/u/addanuj)
#### Post date: [June 12, 2018, 4:13pm UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488/4 "2018-06-12T16:13:55Z")
@jamesspi please help
---
### Author:  [@jamesspi](https://discuss.elastic.co/u/jamesspi)
#### Post date: [June 13, 2018, 8:57am UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488/5 "2018-06-13T08:57:57Z")
Hi @addanuj,
I don't think it's possible to loop through hits. However, I would do this differently.
I would use the ip from the 1st input, and then build the query for the second input using that variable.
Then, the compare condition would need to be based on the result of the second input. You don't even need aggregations in this case really.
So the query for your second input would be something like:
```
"body": {
"query": {
"bool": {
"must": [
{
"query_string": {
"query": "type:threatintel AND indicator-ip:{{ctx.payload.first.hits.hits.0._source.srcip}}"
}
}
]
}
},
```
And the condition:
```
"condition": {
"compare": {
"ctx.payload.second.hits.total": {
"gt": 0
}
}
},
```
Thanks,
James
---
### Author:  [@jamesspi](https://discuss.elastic.co/u/jamesspi)
#### Post date: [June 13, 2018, 9:03am UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488/6 "2018-06-13T09:03:53Z")
> [@jamesspi](#):
>
> ```auto
>
> ```
>
> And the condition:
And I should mention - you should probably be doing the comparison at the entry level (I assume you're using logstash?) using the translate filter plugin. Then just create a watch to see if there is a match. What I usually do is create a boolean field with the translate plugin, and then just watch for value=true. Much more efficient.
---
### Author:  [@addanuj](https://discuss.elastic.co/u/addanuj)
#### Post date: [June 13, 2018, 9:07am UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488/7 "2018-06-13T09:07:05Z")
Can you provide an example for this
---
### Author:  [@addanuj](https://discuss.elastic.co/u/addanuj)
#### Post date: [June 13, 2018, 9:33am UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488/8 "2018-06-13T09:33:13Z")
Hi James,
i tried it but it is not comparing all threatintel IP address with all srcip values, it only compare first one.
but i tried this -
"bool": {
"must": [
{
"query\_string": {
"query": "indicator:{{#ctx.payload.first.aggregations.srcip.buckets}}{{key}} {{/ctx.payload.first.aggregations.srcip.buckets}}"
}
}
]
}
this works for me but i need to know how shall i print matching values only in action seciton
---
### Author:  [@jamesspi](https://discuss.elastic.co/u/jamesspi)
#### Post date: [June 13, 2018, 9:40am UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488/9 "2018-06-13T09:40:27Z")
You won't need to compare all values, you just need to know when there is a match, correct?
Here is a link for some translate examples:
> **[Data Enrichment - Security Examples](https://www.elastic.co/blog/elasticsearch-data-enrichment-with-logstash-a-few-security-examples)**
>
> Data enrichment provides additional insights into your data, and is frequently used in Security use cases. Enrich your data with blacklists, asset inventories, and detect malware.
---
### Author:  [@richcollier](https://discuss.elastic.co/u/richcollier)
#### Post date: [June 13, 2018, 3:09pm UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488/10 "2018-06-13T15:09:08Z")
I've already recommended in [a different thread](https://discuss.elastic.co/t/how-to-compare-two-different-fields-value-of-two-different-index/132533/) that you should look at this post for ideas:
> [@Comparing values from 2 ML Jobs in watcher](https://discuss.elastic.co/t/comparing-values-from-2-ml-jobs-in-watcher/118882/4):
>
> Ok - after a little research, this could be done in probably two ways Method 1 - a script on the condition to see if there's an intersection of results from both queries "condition": { "script": "def second\_results = ctx.payload.second.hits.hits.stream().map(hit-\>hit.\_source.partition\_field\_value).collect(Collectors.toList()); return ctx.payload.first.hits.hits.stream().map(hit -\> hit.\_source.partition\_field\_value).filter(p-\>second\_results.contains(p)).collect(Collectors.toList()).si…
Why do you keep on asking? I'm confused...
---
### Author:  [@addanuj](https://discuss.elastic.co/u/addanuj)
#### Post date: [June 13, 2018, 3:12pm UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488/11 "2018-06-13T15:12:50Z")
Thanks James, for guiding me to the right way. i will try to use logstash method also, but your answer helped me to solve some specific problems anyway,
I am really thankful to this forum and you guys, providing great support to community.
---
### Author:  [@jamesspi](https://discuss.elastic.co/u/jamesspi)
#### Post date: [June 19, 2018, 7:08am UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488/12 "2018-06-19T07:08:33Z")
No problem!
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [June 22, 2018, 2:04pm UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488/13 "2018-06-22T14:04:47Z")
Using a painless script and a chained input that executes both of hte searches you mentioned in the top might be another solution.
Be aware that something like joins do not work though!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 20, 2018, 2:05pm UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488/14 "2018-07-20T14:05:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.