[KQL] Allow comparing the values for different fields

[lukasolson]

Describe the feature:

It would be great if you could compare the values for different fields inside KQL, such as the following:

geo.src = geo.dest or memory <= phpmemory

This sort of thing should be possible using runtime fields.

[elasticmachine]

Pinging @elastic/kibana-app-services (Team:AppServices)

[katdti]

Yes - please add this feature.
I am missing more advanced search options when doing ad-hoc investigating of logs.
Inspiration:
https://docs.datalust.co/docs/sql-queries
allows easy search and convert of result into graphs
(No- I do not work at datalust)

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)

[lukasolson]

Just wanted to add that this is currently possible (although not the most user friendly) by creating a runtime and filtering on it. For example, to filter documents where geo.src = geo.dest, you can create a field, srcdest with the following script:

emit(doc['geo.src'].value == doc['geo.dest'].value)

Then, in the KQL bar, you can query for srcdest: true.

[lukasolson]

Related: elastic/elasticsearch#34400

[kertal]

@lukasolson I'd consider this as blocked since it should be preferable implemented on ES side? WDYT?

[kertal]

I like the functionality neithertheless :)

[kertal]

Closing this because it's not planned to be resolved in the foreseeable future. It will be tracked in our Icebox and will be re-opened if our priorities change. Feel free to re-open if you think it should be melted sooner.

This works when using ES|QL https://www.elastic.co/guide/en/elasticsearch/reference/current/esql.html