Hello all,
I have two index, one include fields “flow.client_hostname” and “flow.bytes”, now I can get alert with this index when client_hostname traffic is exceed 5GB.
And I also have other index which include fields “_source.username” and “_source.srcip”, now I want get the username when “flow.client_hostname” equal “_source.srcip”. but I’m stuck in how to get the username , I also use the scrip to compare fields with two index, so would someone please give some advices, thanks in advance.
