# Elasticsearch filter is not working in logstash

**URL:** <https://discuss.elastic.co/t/elasticsearch-filter-is-not-working-in-logstash/75995>\
**Category:** Logstash\
**Created:** [February 22, 2017, 7:45am UTC](https://discuss.elastic.co/t/elasticsearch-filter-is-not-working-in-logstash/75995 "2017-02-22T07:45:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\
**Post date:** [February 22, 2017, 7:45am UTC](https://discuss.elastic.co/t/elasticsearch-filter-is-not-working-in-logstash/75995/1 "2017-02-22T07:45:44Z")

</div>

Hi,  
I'm using new version of logstash(5.2.0) and i'm facing correlation issue in that. Kinldy find the below detail of my issue,

Actually im trying to move some fields from index 1 to another index 2.  
Already i processed the index 1 data and indexed in elasticsearch. Elasticsearch filter condition is written in index 2 to fetch the value from index 1. Please find the elasticsearch query below

```
elasticsearch {
				query_template => "/template.json"
			  					
		               }

```

template.json

```
{
    "query": {
      "query_string": {
       "query": "type:gvsh_reqold AND dlr_dlrCode:%{dlr_dlrCode} AND getVehicle_VIN:%{getVehicle_VIN}"
      }
    },
   "_source": ["vehicle_SSC","vehicle_SSC"]
 }

```

i want to tranfer the vehicle\_SSC from index 1 to index 2. I'm not getting any error in logstash and please find the logstash message below,

`[2017-02-21T23:37:46,627][INFO][logstash.filters.elasticsearch] Querying elasticsearch for lookup {:params=>{:index=>"", :body=>{"query"=>{"query_string"=>{"query"=>"type:gvsh_reqold AND dlr_dlrCode:0231236 AND getVehicle_VIN:abcd123"}}, "_source"=>["vehicle_SSC", "vehicle_SSC"]}}}`

Please help me to resolve this issue asap.

---

<div class="post-metadata">

**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\
**Post date:** [February 23, 2017, 7:23am UTC](https://discuss.elastic.co/t/elasticsearch-filter-is-not-working-in-logstash/75995/2 "2017-02-23T07:23:18Z")

</div>

@magnusbaeck can you give me the solution for my query

---

<div class="post-metadata">

**Author:** ![rajkamalkool6](https://avatars.discourse-cdn.com/v4/letter/r/e9c0ed/32.png) [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\
**Post date:** [February 28, 2017, 5:48am UTC](https://discuss.elastic.co/t/elasticsearch-filter-is-not-working-in-logstash/75995/3 "2017-02-28T05:48:52Z")

</div>

Hi Ganesh,

I am also facing the same issue. Please let me know if you have find any solution for it.

@elasticsearch is there any bug on this version which correlation is not happening as expected. It was working fine in my previous version 2.3 and 2.4

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2017, 5:49am UTC](https://discuss.elastic.co/t/elasticsearch-filter-is-not-working-in-logstash/75995/4 "2017-03-28T05:49:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.