Is it possible to pass a field value from one rule to another?

[nvasoft]

Hi,
There is Rule1: index: "filebeat-*", I'm filtering out a malicious URLs from an external IPS address. I save them in a flat file. Here is an example of a "url.txt" file with regular DNS queries:

www.google.com
edge.microsoft.com
ctldl.windowsupdate.com

In a real file, there can be from 10 to 30 malicious URLs, depending on the sensitivity threshold configured. The flat file is updated if IPS detects a new threat. Once a week I suppose to create a zero file, for relevance and not to increase search queries.
To find which host on the internal network accesses these malicious URLs, I created Rule2: index: "microsoft.dns-*", I need to pass this list from a file "url.txt" to the filter query string.
Opt. 1: I tried the blacklist rule, it doesn't work properly. The rule is simple, so I couldn't calculate (in enhancements) the number of hits for each stream during the aggregation period, and the num_hits field does not correspond to the exact number of events for 2 hours of aggregation. Similar to the metric and cardinality rules:
match[self.rule["type"].metric_key] or len(self.rule["type"].cardinality_cache[eval(list_qk)]).
Opt. 2: In the enhancements for Rule2, if there is a match between the dns.question.name field in the "microsoft.dns-*" index and the list in the flat file, then I complete the break function, else raise DropMatchException(). This works if you set up a filter in the rule and cut off unnecessary events. But not for Microsoft DNS Debug, there you have to block almost everything, and this is a lot of drop requests.
Opt. 3: Generate a file with the query string format (query: "dns.question.name: www.google.com OR edge.microsoft.com …”) and add the file to Rule2 via import:. But, I have basic settings transferred through import, it is not possible to import two files. You can of course add a filter to the end of the file and use only for this Rule2.
P.S. Or pass the value through the dns_name variable, query: "dns.question.name:'{match[dns_name]}'". This is how I did it for the alerts in the Hive when I passed the value severity: '{match[alert_severity]}'. By setting alert_severity to [1-4] depending on the log.level field (low, medium, high, critical)
Opt. 4: Modify the metric_aggregation rule to allow adding a blacklist if it is present in the rule, otherwise: the rule will be processed as before. It would be ideal if the metric rule could use list from the file.

A situation in which no progress is possible, a deadlock…
I am out of ideas, please advise

[jertel]

For Opt 3, per the docs:

Your statement claiming that you can only import one file per rule is in conflict with the documentation and the logic within the code.

[nvasoft]

Thanks!
I was confused by this old topic Yelp/elastalert#572, which states that you can use one file at a time.

@jertel, Will the string query be updated when the data in url.txt is updated or will Elastalert have to be reloaded?
Which way to realize this is preferable?