# Two index query, linking field **URL:** \ **Category:** Elasticsearch\ **Created:** [January 4, 2019, 10:19am UTC](https://discuss.elastic.co/t/two-index-query-linking-field/162933 "2019-01-04T10:19:47Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![tonelk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tonelk/32/39448_2.png) [@tonelk](https://discuss.elastic.co/u/tonelk)\ **Post date:** [January 4, 2019, 10:19am UTC](https://discuss.elastic.co/t/two-index-query-linking-field/162933/1 "2019-01-04T10:19:47Z")
Hi, I justs started with Elasticsearch in order to analyse our network data. So far it works well and above expectation. The netflow data goes to the index log\_netflow: "\_source" : { "host" : "192.168.1.1", "type" : "netflow", "@timestamp" : "2019-01-04T00:28:05.000Z", "netflow" : { "protocol" : 6, "ipv4\_src\_addr" : "172.16.0.170", "l4\_src\_port" : 5500, "ipv4\_dst\_addr" : "10.0.0.2", "l4\_dst\_port" : 23, }, and all kinds of queries work just fine. Now I created a new index: whitelist\_ip "\_source" : { "name" : "desktop", "ipaddr" : "192.168.1.4", "description" : "sysop pc" }, in which I added the IP's that are 'allowed'. But now i'm stuck on the next step ......How can I create a query that only gives met the log\_netflow records of which the "ipv4\_src\_addr" is not in whitlisted in "ipaddr" ?? Can someone points me in the right direction 🙄 ? Thnx, Ton. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 1, 2019, 10:19am UTC](https://discuss.elastic.co/t/two-index-query-linking-field/162933/2 "2019-02-01T10:19:51Z")
Closed on February 1, 2019, 10:19am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.