# Querying a field name across multiple indices for identical value

**URL:** <https://discuss.elastic.co/t/querying-a-field-name-across-multiple-indices-for-identical-value/301436>\
**Category:** Kibana\
**Created:** [April 3, 2022, 7:52pm UTC](https://discuss.elastic.co/t/querying-a-field-name-across-multiple-indices-for-identical-value/301436 "2022-04-03T19:52:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sectorx](https://avatars.discourse-cdn.com/v4/letter/s/d78d45/32.png) [@sectorx](https://discuss.elastic.co/u/sectorx)\
**Post date:** [April 3, 2022, 7:52pm UTC](https://discuss.elastic.co/t/querying-a-field-name-across-multiple-indices-for-identical-value/301436/1 "2022-04-03T19:52:10Z")

</div>

I was hoping someone can offer a level of guidance. I have an Elasticsearch Enterprise cluster which is made up of three servers. My question is actually a basic one.  
There are two indices that I have -

a) okta-ioc-ip

The key field in this index is ClientIP.keyword

b) okta-potential-breach

There is more data here but the field of interest is ClientIP.keyword

Hence, we have two indices with the same fieldname. What I am attempting to do is query both indicies to determine if the the same ip address exists in both.

Looking for a specific ip address works fine -

```auto
GET okta-potential-breach,okta-ioc-ip/_search
{
  "query": {
    "match": {
      "ClientIP.keyword": "192.124.249.110"
    }
  }
}

```

The results displaying both indices where the IP exists are given. How can I do this if I don't know the IP.

FYI - I tried an indicator match in Rules which was not successful, I was hoping to be able to do this in dev tools.

Please advise and my deepest apologies if the answer is obvious and I have missed it.

---

<div class="post-metadata">

**Author:** ![msanz-acclaro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/msanz-acclaro/32/103661_2.png) [@msanz-acclaro](https://discuss.elastic.co/u/msanz-acclaro)\
**Post date:** [April 4, 2022, 7:19am UTC](https://discuss.elastic.co/t/querying-a-field-name-across-multiple-indices-for-identical-value/301436/2 "2022-04-04T07:19:21Z")

</div>

As far as I know this is not possible; bear in mind you are using a NoSQL architecture, i.e. no relations between databases, you are just indexing and consulting documents (no tables, foreign keys, etc).

You can query more than one index at a time, I do this a lot in dashboards, which would be similar to your example above.

To do what you mention, you would need to create a third index (e.g. through transform) where you input the info from the other indexes into a new one, and then run your queries and reports there.

---

<div class="post-metadata">

**Author:** ![sectorx](https://avatars.discourse-cdn.com/v4/letter/s/d78d45/32.png) [@sectorx](https://discuss.elastic.co/u/sectorx)\
**Post date:** [April 4, 2022, 10:24am UTC](https://discuss.elastic.co/t/querying-a-field-name-across-multiple-indices-for-identical-value/301436/3 "2022-04-04T10:24:48Z")

</div>

Thank you very much, and it is appreciated. This makes perfect sense. Constructing the dashboard would be the path of least resistance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 2, 2022, 10:25am UTC](https://discuss.elastic.co/t/querying-a-field-name-across-multiple-indices-for-identical-value/301436/4 "2022-05-02T10:25:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.