Elasticsearch-Filter-Plugin

Elastic Stack Logstash
1

I have problems with the syntax of the logstash-elasticsearch-filter-plugin

In my case, I've a field named 'executed' and I will check this field of a special value.

How does this work? Something like that?

elasticsearch {
   query => 'executed : 4711'
}
2

I'm not sure you can have spaces on either side of the colon, but otherwise that should work. You'll probably want to copy one or more fields into the current event with the fields option.