# Elasticsearch Filter Syntax

**URL:** https://discuss.elastic.co/t/elasticsearch-filter-syntax/254793
**Category:** Logstash
**Created:** [November 9, 2020, 4:35pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-syntax/254793 "2020-11-09T16:35:24Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ksremo](https://avatars.discourse-cdn.com/v4/letter/k/5fc32e/32.png) [@ksremo](https://discuss.elastic.co/u/ksremo)
#### Post date: [November 9, 2020, 4:35pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-syntax/254793/1 "2020-11-09T16:35:24Z")

</div>

`filter { elasticsearch { hosts => ["https://10. 0.0.20:9200","https://10. 0.0.21:9200","https://10. 0.0.22:9200","https://10. 0.0.23:9200","https://10. 0.0.24:9200","https://10. 0.0.25:9200","https://10. 0.0.26:9200"] ca_file => '/etc/logstash/elasticsearch-ca-neu.pem' user => 'elastic' password => '<password>' index => 'custom-misp-iocs*' query => '(misp.event.ioc.value:"%{[hash.sha256]}")' fields => { "[misp][event][ioc][value]" => "misphash" } fields => { "%{[misp][event][ioc][value]}" => "misphash1" } fields => { "[misp.event.ioc.value]" => "misphash2" } fields => { "misp.event.ioc.value]" => "misphash3" } fields => { "%{[misp.event.ioc.value]}" => "misphash4" } fields => { "@timestamp" => "misphash5" } fields => { "%{[@timestamp}" => "misphash6" } result_size => 1 enable_sort => false } }`

Which is the correct syntax? a misphash field is never created. if i execute query manually it works great.

---

<div class="post-metadata">

### Author: ![ksremo](https://avatars.discourse-cdn.com/v4/letter/k/5fc32e/32.png) [@ksremo](https://discuss.elastic.co/u/ksremo)
#### Post date: [November 9, 2020, 7:49pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-syntax/254793/2 "2020-11-09T19:49:03Z")

</div>

Found it on my own:

`query => 'misp.event.ioc.value:"%{[hash][sha256]}"' fields => { "[misp.event.id]" => "misp_event_id" }`

But i dont really understand when if have to use [event][id] and when [event.id]

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 9, 2020, 8:43pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-syntax/254793/3 "2020-11-09T20:43:13Z")

</div>

> [@ksremo](#):
>
> i dont really understand when if have to use [event][id] and when [event.id]

[event.id] is a field with a dot in its name.

```
{ "event.id": 1 }

```

[event][id] is an object called [event] that contains an [id] field

```
{ "event": { "id": 1 } }

```

logstash uses a different syntax to the rest of the Elastic stack.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 7, 2020, 8:43pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-syntax/254793/4 "2020-12-07T20:43:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.