ES Search Help - How do I multi index join when IP address field is named differently between the two indexes?

[lou_sierra]

I have looked at the join documentation, but I am getting a little lost in translation.
What I am trying to accomplish, is to pull data from Index1, then join on IP address to another index to pull different information and display all of it.

Example:

Index=firewall dest_port=21
| stats values(dest_ip) as dest_ip values(dest_port) as dest_port sum(bytes_in) as bytes_in sum(bytes_out) as bytes_out values(app) as app values(rule) as rule by user src _time

Index=edr RPort=21 RemoteIP=$dest_ip-from-first-search

The output should be a table with the following:
firewall._time, firewall.src, firewall.dest_ip, edr.username, edr.username, edr.processname

The issue I am running into is the IP address field is named differently between the 2 indices.  Ideally I would join on firewall.dest_ip TO edr.RemoteIP

Any help would be appreciated. 

[smurf]

Hi,

I usually just rename the join field at the end of the subsearch or create the join field in the original search with eval.

It could look something like this:

index=firewall
| fields firewall._time, firewall.src, firewall.dest_ip
| eval edr.RemoteIP = firewall.dest_ip
| join 
    [ index=edr 
    | fields edr.username, edr.username, edr.processname edr.RemoteIP ]

smurf