# Can I access the \_score for events from an elasticsearch input in logstash?

**URL:** <https://discuss.elastic.co/t/can-i-access-the-score-for-events-from-an-elasticsearch-input-in-logstash/102873>\
**Category:** Logstash\
**Created:** [October 5, 2017, 4:31pm UTC](https://discuss.elastic.co/t/can-i-access-the-score-for-events-from-an-elasticsearch-input-in-logstash/102873 "2017-10-05T16:31:00Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 5, 2017, 4:31pm UTC](https://discuss.elastic.co/t/can-i-access-the-score-for-events-from-an-elasticsearch-input-in-logstash/102873/1 "2017-10-05T16:31:00Z")

</div>

logstash is pulling data out of elasticsearch using the following query

```
query => '{
  "_source": false,
  "query": { 
    "function_score": {
      "query": { "query_string": { "query": "*" } },
      "random_score": {}
    }
  }
}'
```

Is there a way to access the \_score metadata that I can see when I run the query in the Console? I tried 'add\_field =\> { "score" =\> "%{[@metadata][\_score]}" }' and that did not work.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 5, 2017, 7:43pm UTC](https://discuss.elastic.co/t/can-i-access-the-score-for-events-from-an-elasticsearch-input-in-logstash/102873/2 "2017-10-05T19:43:30Z")

</div>

Have a look at the elasticsearch input's `docinfo` option.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 5, 2017, 7:44pm UTC](https://discuss.elastic.co/t/can-i-access-the-score-for-events-from-an-elasticsearch-input-in-logstash/102873/3 "2017-10-05T19:44:54Z")

</div>

On second thoughts I'm not sure `_score` is among the metadata fields that you can extract that way.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 6, 2017, 1:23am UTC](https://discuss.elastic.co/t/can-i-access-the-score-for-events-from-an-elasticsearch-input-in-logstash/102873/4 "2017-10-06T01:23:34Z")

</div>

Nope, `_score` is calculated at query time, it's never stored in a document as a field.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 12, 2017, 6:31pm UTC](https://discuss.elastic.co/t/can-i-access-the-score-for-events-from-an-elasticsearch-input-in-logstash/102873/5 "2017-10-12T18:31:36Z")

</div>

@warkolm, I get that, but it is part of the data returned by elasticsearch to logstash, so logstash could have chosen to make it available.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 12, 2017, 9:16pm UTC](https://discuss.elastic.co/t/can-i-access-the-score-for-events-from-an-elasticsearch-input-in-logstash/102873/6 "2017-10-12T21:16:02Z")

</div>

True, please do feel free to raise a feature request against the plugin 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2017, 9:16pm UTC](https://discuss.elastic.co/t/can-i-access-the-score-for-events-from-an-elasticsearch-input-in-logstash/102873/7 "2017-11-09T21:16:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.