# Elasticsearch filter plugin query question

**URL:** <https://discuss.elastic.co/t/elasticsearch-filter-plugin-query-question/101998>\
**Category:** Logstash\
**Created:** [September 27, 2017, 2:25pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-query-question/101998 "2017-09-27T14:25:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![iStepich](https://avatars.discourse-cdn.com/v4/letter/i/dbc845/32.png) [@iStepich](https://discuss.elastic.co/u/iStepich)\
**Post date:** [September 27, 2017, 2:25pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-query-question/101998/1 "2017-09-27T14:25:02Z")

</div>

Hello!  
I need to join some responses and requests to have request time in response JSON.  
For each request-response pair I have unique trace\_id that looks like "dd4b46b0-44da-473e-8775-d90cce583b0f"  
Solution for that was shown up in [example](https://www.elastic.co/guide/en/logstash/current/lookup-enrichment.html)  
My logstash config:  
filter {  
elasticsearch  
{  
hosts =\> ["127.0.0.1:9200"]  
query =\> "trace\_id:%{[trace\_id]}"  
fields = {"time" =\> "req\_timestamp"}  
}  
}  
Problem is that when I look for trace\_id "dd4b46b0-44da-473e-8775-d90cce583b0f" it gives me the time of th request with trace\_id "3447da40-473e-4518-b8cd-4a742f419647" because they have the same part "473e".  
How to look for a complete trace\_id match using this plugin?

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [September 28, 2017, 1:49pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-query-question/101998/2 "2017-09-28T13:49:22Z")

</div>

I'd suppose it has something to do with the _trace\_id_ field being analyzed by default in ElasticSearch and broken down in parts between dashes, hence you get the partial match . You can verify it by checking the mapping of the index or the general template (if one exists).

For a verbatim match try querying the _trace\_id.keyword_ subfield (which should be mapped by default if you're using a recent version of ElasticSearch), like so:

```auto
filter {
  elasticsearch {
    hosts => ["127.0.0.1:9200"]
    query => "trace_id.keyword:%{[trace_id]}"
    fields = {
      "time" => "req_timestamp"
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![iStepich](https://avatars.discourse-cdn.com/v4/letter/i/dbc845/32.png) [@iStepich](https://discuss.elastic.co/u/iStepich)\
**Post date:** [October 5, 2017, 12:29pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-query-question/101998/3 "2017-10-05T12:29:51Z")

</div>

did it with  
query =\> 'trace\_id:"%{[trace\_id]}"'

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 2, 2017, 12:30pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-query-question/101998/4 "2017-11-02T12:30:14Z")

</div>

Closed on November 2, 2017, 12:30pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.