# Elasticsearch filter plugin configuration not working

**URL:** https://discuss.elastic.co/t/elasticsearch-filter-plugin-configuration-not-working/192497
**Category:** Logstash
**Created:** [July 26, 2019, 7:59pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-configuration-not-working/192497 "2019-07-26T19:59:14Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![mtudisco](https://avatars.discourse-cdn.com/v4/letter/m/3d9bf3/32.png) [@mtudisco](https://discuss.elastic.co/u/mtudisco)
#### Post date: [July 26, 2019, 7:59pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-configuration-not-working/192497/1 "2019-07-26T19:59:14Z")

</div>

I'm new to elasticsearch and i'm trying to get the last known state from a database to compare it with the actual status, however something is not working

input {  
exec {  
command =\> "sh -c '/usr/local/bin/chkdb.sh'"  
interval =\> 30  
type =\> "db\_status"  
}  
}  
filter {  
if [type] == "db\_status" {  
if [message] =~ /OK/ {  
mutate {  
add\_field =\> ["oradb\_status", "UP"]  
}  
} else {  
mutate {  
add\_field =\> ["oradb\_status", "DOWN"]  
}  
}  
elasticsearch {  
query =\> "type:db\_status"  
fields =\> { "oradb\_status" =\> "prev\_stat" }  
}  
}  
}  
output {  
stdout { codec =\> rubydebug }  
elasticsearch { hosts =\> ["localhost:9200"]  
index =\> "oracle-%{[type]}-%{+YYYY.MM.dd}"  
}  
}

however when i query the index the field prev\_stat is always empty.

Anyone cant tell me what am i doing wrong?

The /usr/local/bin/chkdb.sh script returns OK or ERROR depending if DB is UP or not and its working as in field oradb\_status i'm getting values

thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 23, 2019, 7:59pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-configuration-not-working/192497/2 "2019-08-23T19:59:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
