# Ealasticsearch filter

**URL:** <https://discuss.elastic.co/t/ealasticsearch-filter/147261>\
**Category:** Logstash\
**Created:** [September 4, 2018, 7:30pm UTC](https://discuss.elastic.co/t/ealasticsearch-filter/147261 "2018-09-04T19:30:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pierre2](https://avatars.discourse-cdn.com/v4/letter/p/da6949/32.png) [@Pierre2](https://discuss.elastic.co/u/Pierre2)\
**Post date:** [September 4, 2018, 7:30pm UTC](https://discuss.elastic.co/t/ealasticsearch-filter/147261/1 "2018-09-04T19:30:57Z")

</div>

Hi,

I use Logstash with two pipelines. The first will process log file comming from SVI (Vocal server) and index fields into the index called "svi".The second pipeline process CDR (call details records) and index fields into the "cdr\_sbc" index.

In the second logstash config I use the elasticsearch filter to copy fields from the document that has the same "ID appelSVI" in the "svi" index to the document in the "cdr\_sbc" index.

So there is the situation. First the first pipeline process the logs from the SVI and I obtain this document with this "ID appelSVI" :

 ![capture%20svi%20index](https://us1.discourse-cdn.com/elastic/original/3X/1/c/1cb3eb05b503b05d90852526ab355cb0d1aa99e9.jpeg)

After that the second pipeline run and process CDR. In the logstash config I used the elasticsearch filter  
:

> elasticsearch{  
> hosts =\> ["localhost:9200"]  
> index=\> "svi"  
> query =\> "ID appelSVI:%{ID appelSVI}"  
> fields =\>{  
> "UD\_CODESVI" =\> "UD\_CODESVI"  
> }  
> }

I think my config is not bad. I obtain this message that tell me that there is no "ID appelSVI" in the "svi" index that match witch the "ID appelSVI" obtained in the CDR ;  
 ![erreur%20elasticsearch%20filter](https://us1.discourse-cdn.com/elastic/original/3X/b/3/b34e99687c3e79f726baa72c9840b4914468b62b.jpeg)

There is a screenshot from the document in the "cdr\_sbc" index that has this "ID appelSVI". As you can see that's the same that those in the "svi" index (there is no spaces at the beginning or at the end).

 ![index%20cdr_sbc](https://us1.discourse-cdn.com/elastic/original/3X/2/d/2d15839957133db09700c6e7a0ce5f12b8a5a7fe.jpeg)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 2, 2018, 7:31pm UTC](https://discuss.elastic.co/t/ealasticsearch-filter/147261/2 "2018-10-02T19:31:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.