Comparison of data between two indices

s.buksa
Tue, 14 Oct 2025 18:50:00 +0000
Elasticsearch

Hello,

I'm looking for suggestions.
I have two indices, for example:

1. index-a-2025

2. index-b-2025

Both indices contain Beat host names on which they are deployed. I want to compare both indices to identify any missing host names (i.e., the difference) between them.

Assuming I know that there are 1,000 Beat host names (stored in the field beats_host_name) in index-a-2025 and 980 Beat host names (stored in the field beats_stats_host_name) in index-b-2025, what would be the best way to quickly retrieve the 20 host names that exist in index-a-2025 but not in index-b-2025?

Could this be achieved using a Watcher that’s manually executed and returns those 20 host names? Or perhaps through a visualization in a dashboard?
I would really appreciate any guidance or suggestions.

4 posts - 3 participants