Hi @EmeraldHerald - Thanks for your help. Please see the below inputs for a failed merge. For the merge node settings, I have included the workflow as well. I’m basically doing a left join here. However, n8n would just output what I have for input 1 as a result but in a separate output tab for some reason.
Input 1
[
{
"_index": "index-2023.08.01-000000",
"_type": "_doc",
"_id": "a_sYcbTySeiLQ3JZQ0iEEQ",
"_score": 3,
"_source": {
"@timestamp": "2023-08-01T00:20:42.422136+00:00",
"alert_id": "a_sYcbTySeiLQ3JZQ0iEEQ",
"rule_name": "Just a title",
"rule_severity": 2,
"alert_key": "1.1.1.1",
"lookup_matches": null,
"user_name": [],
"src_ip": [
"8.8.8.8",
"1.1.1.1"
],
"dv_dst_ip": [
"20.20.20.20"
],
"hostname": []
}
}
]
Input 2
[
{
"_id": "~21700856",
"_type": "Alert",
"_createdBy": "[email protected]",
"_updatedBy": "[email protected]",
"_createdAt": 1691108609952,
"_updatedAt": 1691108610140,
"type": "Alert",
"source": "XXX-8.8.8.8-1.1.1.1",
"sourceRef": "a_sYcbTySeiLQ3JZQ0iEEQ",
"title": "Just a title",
"description": "Alert from Rules",
"severity": 2,
"date": 1691108442422,
"tags": [],
"tlp": 2,
"pap": 2,
"read": true,
"follow": true,
"customFields": [
{
"_id": "~rmx3z-cx4hk-19ud-3a8",
"name": "alert_id",
"description": "Unique Alert ID",
"type": "string",
"value": "a_sYcbTySeiLQ3JZQ0iEEQ",
"order": 0
}
{
"_id": "~rmyov-cx4hk-19ud-9hc",
"name": "abuseipdb_score",
"description": "AbuseIPDB Score",
"type": "string",
"value": null,
"order": 0
}
],
"observableCount": 3,
"caseId": "~2490424",
"extraData": {}
}
]