Query to return missing value from known values

Elastic Stack Elasticsearch
1

I have created a static custom index to hold the known hostnames of my machines and have the following items as shown below.

index: hosts
"hostname": [ "betty", "bob", "fred" ]

I want to query my index below with the hostnames from my index above and return any names not found.

index: logstash-*
"system.auth.hostname": "betty"
"system.auth.hostname": "bob"

My expected result would be to return the name fred since he wasn't found in the second index.

Any input would be appreciated. Thanks.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.