# Elasticsearch-Filter-Plugin

**URL:** https://discuss.elastic.co/t/elasticsearch-filter-plugin/47386
**Category:** Logstash
**Created:** [April 14, 2016, 12:40pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin/47386 "2016-04-14T12:40:54Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![diwertowski](https://avatars.discourse-cdn.com/v4/letter/d/ac91a4/32.png) [@diwertowski](https://discuss.elastic.co/u/diwertowski)
#### Post date: [April 14, 2016, 12:40pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin/47386/1 "2016-04-14T12:40:54Z")

</div>

I have problems with the syntax of the logstash-elasticsearch-filter-plugin

In my case, I've a field named 'executed' and I will check this field of a special value.

How does this work? Something like that?

```
elasticsearch {
   query => 'executed : 4711'
}
```

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 18, 2016, 9:01pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin/47386/2 "2016-04-18T21:01:20Z")

</div>

I'm not sure you can have spaces on either side of the colon, but otherwise that should work. You'll probably want to copy one or more fields into the current event with the `fields` option.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin/47386/3 "2017-07-06T05:01:48Z")

</div>