# Watcher - Alarm to match two field from two index **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [November 24, 2019, 6:59pm UTC](https://discuss.elastic.co/t/watcher-alarm-to-match-two-field-from-two-index/209195 "2019-11-24T18:59:58Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![carmezsa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carmezsa/32/59443_2.png) [@carmezsa](https://discuss.elastic.co/u/carmezsa)\ **Post date:** [November 24, 2019, 6:59pm UTC](https://discuss.elastic.co/t/watcher-alarm-to-match-two-field-from-two-index/209195/1 "2019-11-24T18:59:58Z")
I am trying to deploy a watcher to my lab home. I have logs from zeek (json) and logs from intelmq (Threat Intelligence Sharing). I need compare one field from zeek\_index (field: id.resp\_h) with one field from intelmq\_index (field: source.ip). If they match I would like write a log with a text. My issue is de input and contidion. ---------begin my watcher-------- PUT \_watcher/watch/checkIP { "metadata" : { "color" : "red" }, "trigger" : { "schedule" : { "interval": "30s" } }, "input" : { "search": { "request": { "indices": ["filebeat\_zeek-\*"], "body": { "size" : 0, "query": { "match": {"source.ip": "108.61.187.24"} } } } } }, "condition" : { "compare" : { "ctx.payload.hits.total.value" : { "gt" : 1 }} }, "actions" : { "log\_error" : { "logging" : { "text" : "ohhh! {{ctx.payload.hits.total.value}} . chek the network. Malware on!" } } } } ---------end my watcher---------- I can search on kibana the ip, but the alert not mutch. nota: I would like change \>"match": {"source.ip": "108.61.187.24"}"\< with the intelmq\_index.field, but if the simple examplo fail, something more complex is an error. thanks ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [November 28, 2019, 9:22am UTC](https://discuss.elastic.co/t/watcher-alarm-to-match-two-field-from-two-index/209195/2 "2019-11-28T09:22:48Z")
I am not sure I fully understand the requirement. Would it make sense to execute two searches, one in the zeek, another in the intel\_mq index for that IP and then check if both return hits? ---
**Author:** ![carmezsa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carmezsa/32/59443_2.png) [@carmezsa](https://discuss.elastic.co/u/carmezsa)\ **Post date:** [November 28, 2019, 8:24pm UTC](https://discuss.elastic.co/t/watcher-alarm-to-match-two-field-from-two-index/209195/3 "2019-11-28T20:24:19Z")
I'm sorry, I try to explain better. - I have two feed information (zeek\_index) and (intelmq\_index). - Zeek\_index have one field named "destination-ip" - Intelmq\_index have one field named "source-ip" - I need to compare all "zeek\_index" "destination-ip" value with all "intelmq\_index" "source-ip" values. - If one "destination-ip" == "source-ip", send an email, log, or index. I try to write the rigth code but I don't know how I can "search" and "compare" it to make it ok. In my example I use [["match": {"source.ip": "108.61.187.24"}]] to check it was ok, I doesn't work. I think that I must to compare ip from zeek (zeek\_index - destination-ip) with all (intelmq\_index - source-ip) and send the resolt if it match. Best regard ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [November 29, 2019, 8:43am UTC](https://discuss.elastic.co/t/watcher-alarm-to-match-two-field-from-two-index/209195/4 "2019-11-29T08:43:24Z")
I cannot think of any efficient way of doing this, as you need to compare every entry of one index with every entry of another index. And I suppose the ip address space can be arbitrarily high (given IPv6)? ---
**Author:** ![carmezsa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carmezsa/32/59443_2.png) [@carmezsa](https://discuss.elastic.co/u/carmezsa)\ **Post date:** [December 1, 2019, 10:17am UTC](https://discuss.elastic.co/t/watcher-alarm-to-match-two-field-from-two-index/209195/5 "2019-12-01T10:17:09Z")
> [@spinscale](#): > > I cannot think of any efficient way of doing this, as you need to compare every entry of one index with every entry of another index. And I suppose the ip address space can be arbitrarily high (given IPv6)? I do not search an efficient method now. It will be the second step. I need search and match one list of string (ip address) in my zeek index. IPv6 will be third step. Some idea to go for the correct route? Thanks. ---
**Author:** ![carmezsa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carmezsa/32/59443_2.png) [@carmezsa](https://discuss.elastic.co/u/carmezsa)\ **Post date:** [December 14, 2019, 3:06am UTC](https://discuss.elastic.co/t/watcher-alarm-to-match-two-field-from-two-index/209195/6 "2019-12-14T03:06:02Z")
Where I can study some "watchers" to compara two fields from two diferents indexes? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 11, 2020, 3:18am UTC](https://discuss.elastic.co/t/watcher-alarm-to-match-two-field-from-two-index/209195/7 "2020-01-11T03:18:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.