# Cant access fields from log using query template for Elasticsearch filter in Logstash
**URL:** https://discuss.elastic.co/t/cant-access-fields-from-log-using-query-template-for-elasticsearch-filter-in-logstash/214291
**Category:** Logstash
**Created:** [January 8, 2020, 6:20pm UTC](https://discuss.elastic.co/t/cant-access-fields-from-log-using-query-template-for-elasticsearch-filter-in-logstash/214291 "2020-01-08T18:20:42Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@james.garside](https://discuss.elastic.co/u/james.garside)
#### Post date: [January 8, 2020, 6:20pm UTC](https://discuss.elastic.co/t/cant-access-fields-from-log-using-query-template-for-elasticsearch-filter-in-logstash/214291/1 "2020-01-08T18:20:42Z")
## Cant access fields from log using query template
I have an instance of logstash which I want to use to enrich a field on incomming logs by querying elasticsearch then add the result to the recieved log.
I have configured it using the resources available however the field is not being updated.
My configurations are below.
**pipeline.yml**
```
mutate { add_field => { "destination.geo.name" => "none" }}
elasticsearch {
hosts => ["https://eshost1"]
#ssl => true (Not used due to a mention there is a bug with using ssl and instead use https)
ca_file => "/path/to/cert.crt"
user => "logstash"
password => "password"
index => "index-ap*"
query_template => "/path/to/ap_query.json"
fields => { "Map Location" => "destination.geo.name" }
}
```
**ap\_query.json**
```
{
"size": 1,
"sort" : [{ "@timestamp" : "desc" }],
"query": {
"match_phrase": {
"Base Radio MAC Address": "%{[destination][address]}"
}
},
"_source": ["Map Location"]
}
```
Logstash is opertaing completly as expected apart from this section.
Any help would be greatly appreciated.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 5, 2020, 6:20pm UTC](https://discuss.elastic.co/t/cant-access-fields-from-log-using-query-template-for-elasticsearch-filter-in-logstash/214291/2 "2020-02-05T18:20:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.