Write some Software -- 2

I need someone to create search script, ideally using elastalert but not necesary, to tell me if there was any data exchange between src_ip that are flagged as compromised and LAN. Here is the structure: src_ip is in bro_connlog type and contains bytes_transfered; src_ip in bro_intel contains compromised_host but has no bytes_transfered field, its by design by bro ids. In SQL terms, I would join bro_connlog and bro_intel, show which src_ip are in both, then show which src_ip has transfered data to compromised_host(seen intel). Then email the results as with link to Kibana. You would give me either elastalert rule, or some sort of script that can be run comand line on Linux. Iam also looking for Elastic/bro to engage in ongoing work with constant tasks like this and larger.