# Same field answer **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [January 30, 2023, 11:45am UTC](https://community.graylog.org/t/same-field-answer/27491 "2023-01-30T11:45:27Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![yumibad86](https://avatars.discourse-cdn.com/v4/letter/y/c77e96/32.png) [@yumibad86](https://community.graylog.org/u/yumibad86)\ **Post date:** [January 30, 2023, 11:45am UTC](https://community.graylog.org/t/same-field-answer/27491/1 "2023-01-30T11:45:27Z")
Is there any way to show 2 logs (different servers) together if the field response is the same? Example: IP field. I want it to show everything that the result of the IP field is equal. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [January 31, 2023, 12:44am UTC](https://community.graylog.org/t/same-field-answer/27491/2 "2023-01-31T00:44:15Z")
Hello @yumibad86 It might be able to do this with a pipeline. What Are you trying to achieve? ---
**Author:** ![yumibad86](https://avatars.discourse-cdn.com/v4/letter/y/c77e96/32.png) [@yumibad86](https://community.graylog.org/u/yumibad86)\ **Post date:** [January 31, 2023, 12:00pm UTC](https://community.graylog.org/t/same-field-answer/27491/3 "2023-01-31T12:00:30Z")
I would like you to join the 2 logs. Whenever you see the value of the IP field is equal. Filter: source:(“IP\_MX” OR HOST\_SERVER) AND _exists_:IP AND message:(“client\_vpn\_connect” OR “Accepted password”) Log MX: IP\_MX MX\_NAME events client\_vpn\_connect user id ‘username’ local ip xxx.xxx.xxx.xxx connected from xxx.xxx.xxx.xxx Log server: Date HOST\_SERVER sshd[xxxx]: Accepted password for user from xxx.xxx.xxx.xxx port xxxxx ssh2 I would like to get it when the person accesses the vpn and connects to the server. ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [January 31, 2023, 9:31pm UTC](https://community.graylog.org/t/same-field-answer/27491/4 "2023-01-31T21:31:47Z")
Meaning you want an Alert when two messages from separate sources match with IP or do you want to look up all the messages related to the IP and show the results? I suspect the first one, but just checking… because the first one is more difficult. ---
**Author:** ![yumibad86](https://avatars.discourse-cdn.com/v4/letter/y/c77e96/32.png) [@yumibad86](https://community.graylog.org/u/yumibad86)\ **Post date:** [February 1, 2023, 2:26pm UTC](https://community.graylog.org/t/same-field-answer/27491/5 "2023-02-01T14:26:41Z")
That’s right, the first option. I want it to show the log when the IP of mx log and IP of server log is the same. ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [February 1, 2023, 5:18pm UTC](https://community.graylog.org/t/same-field-answer/27491/6 "2023-02-01T17:18:00Z")
The only way I can think of doing that within Graylog is via the [correlation engine](https://go2docs.graylog.org/5-0/interacting_with_your_log_data/correlation_engine.html). You need to have a Operations License to use it though. [Licenses are free](https://www.graylog.org/downloads/free-enterprise/) if you can keep your data within 2GB per day. ---
**Author:** ![yumibad86](https://avatars.discourse-cdn.com/v4/letter/y/c77e96/32.png) [@yumibad86](https://community.graylog.org/u/yumibad86)\ **Post date:** [February 2, 2023, 12:14pm UTC](https://community.graylog.org/t/same-field-answer/27491/7 "2023-02-02T12:14:26Z")
Doesn’t have any filter that reads the field and checks the value if it’s equal? ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [February 2, 2023, 4:01pm UTC](https://community.graylog.org/t/same-field-answer/27491/8 "2023-02-02T16:01:34Z")
For the most part, Graylog interacts one message at a time… though perhaps semi-parallel for speed… once you get beyond the OpenSource version you start getting tools for what you are looking for. I suppose you could build a dashboard that exposes IP cardinality but it would not give you the Alerts you are looking for. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [February 16, 2023, 4:01pm UTC](https://community.graylog.org/t/same-field-answer/27491/9 "2023-02-16T16:01:39Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.