# Compound DSL Querys on Logstash template

**URL:** <https://discuss.elastic.co/t/compound-dsl-querys-on-logstash-template/308965>\
**Category:** Logstash\
**Created:** [July 6, 2022, 1:31am UTC](https://discuss.elastic.co/t/compound-dsl-querys-on-logstash-template/308965 "2022-07-06T01:31:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jubilla073](https://avatars.discourse-cdn.com/v4/letter/j/dfb087/32.png) [@jubilla073](https://discuss.elastic.co/u/jubilla073)\
**Post date:** [July 6, 2022, 1:31am UTC](https://discuss.elastic.co/t/compound-dsl-querys-on-logstash-template/308965/1 "2022-07-06T01:31:14Z")

</div>

Hi guys,

Today, i working to include query's templates into my logstash pipelines. In this use case, i need search by two factors, an especific field and only get last X hours (around 6 hours). For this, i wrote a Compound DSL Query with boolean characteristic, that works succesfully on Kibana Dev Tools, but when include that into query template in logstash and reload, fail and show the following message:

[2022-07-05T22:06:54,956][INFO][logstash.javapipeline][dkt-ecm.conf] Pipeline terminated {"pipeline.id"=\>"dkt-ecm.conf"}  
[2022-07-05T22:06:54,988][ERROR][logstash.agent] Failed to execute action {:id=\>:"dkt-ecm.conf", :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create\<dkt-ecm.conf\>, action\_result: false", :backtrace=\>nil}

This is a part of context pipeline:

```auto
elasticsearch {
      hosts => ["es02"]
      ca_file => '/usr/share/logstash/config/certs/ca.crt'
      ssl => true
      user => ' **************'
      password => ' **************'
      index => " *********"
      query_template => "/usr/share/logstash/querytemplate/srcip_ls.json"
      fields => {
        "host_saved" => "srcHost_ELK"
      }
    }

```

and this is the query template

```auto
{
  "query": {
    "bool" : {
      "must" : {
        "term" : { "ip_saved" : "%{srcip_ls}" }
      },
      "filter": {
        "range": { "@timestamp" : { "gte" : "now-6h/h" }}
      }
    }
  }
}

```

Please help me.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 3, 2022, 1:31am UTC](https://discuss.elastic.co/t/compound-dsl-querys-on-logstash-template/308965/2 "2022-08-03T01:31:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.