# Elasticsearch Input Seems To Not Use Provided Query - It Just Dumps All docs in Index

**URL:** <https://discuss.elastic.co/t/elasticsearch-input-seems-to-not-use-provided-query-it-just-dumps-all-docs-in-index/97157>\
**Category:** Logstash\
**Created:** [August 15, 2017, 10:54pm UTC](https://discuss.elastic.co/t/elasticsearch-input-seems-to-not-use-provided-query-it-just-dumps-all-docs-in-index/97157 "2017-08-15T22:54:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cb2015](https://avatars.discourse-cdn.com/v4/letter/c/7993a0/32.png) [@cb2015](https://discuss.elastic.co/u/cb2015)\
**Post date:** [August 15, 2017, 10:54pm UTC](https://discuss.elastic.co/t/elasticsearch-input-seems-to-not-use-provided-query-it-just-dumps-all-docs-in-index/97157/1 "2017-08-15T22:54:34Z")

</div>

Hello, I am trying to use the Elasticsearch input but keep running into trouble. It seems like the input does not care about the query I give it. Instead, I just see logstash spew out every document in the index.

This is my logstash config -

```
    input {
  # Returns all campaigns in a day with >100,000 emails sent and stores the output in a file.
  elasticsearch {
    hosts => [localhost]
    query => {
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "*",
            "analyze_wildcard": true
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "now-2d/d",
              "lte": "now-1d/d",
              "format": "epoch_millis"
            }
          }
        }
      ],
      "must_not": []
    }
  },
  "_source": {
    "excludes": []
  },
  "aggs": {
    "3": {
      "terms": {
        "field": "Campaign_ID.keyword",
        "size": 1000,
        "min_doc_count": 100000,
        "order": {
          "_count": "desc"
        }
      }
    }
  }
}
  	index => "powermta-*"
  }
}
output {stdout { codec => rubydebug }}

```

The output when I run this query is

```
  "took": 531,
  "timed_out": false,
  "_shards": {
"total": 385,
"successful": 385,
"failed": 0
  },
  "hits": {
    "total": 7705389,
"max_score": 0,
"hits": []
  },
  "aggregations": {
"3": {
  "doc_count_error_upper_bound": 0,
  "sum_other_doc_count": 0,
  "buckets": [
    {
      "key": "34748",
      "doc_count": 893660
    },
    {
      "key": "50059",
      "doc_count": 770699
    },...

```

Which is what I want.

Could someone help me figure out why the Elasticsearch input is not giving me the data I want?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 17, 2017, 5:12am UTC](https://discuss.elastic.co/t/elasticsearch-input-seems-to-not-use-provided-query-it-just-dumps-all-docs-in-index/97157/2 "2017-08-17T05:12:41Z")

</div>

I'm very surprised that your configuration doesn't upset the config file syntax checker. AFAIK the `query` option is supposed to contain a (JSON) string. See examples in the docs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 14, 2017, 5:12am UTC](https://discuss.elastic.co/t/elasticsearch-input-seems-to-not-use-provided-query-it-just-dumps-all-docs-in-index/97157/3 "2017-09-14T05:12:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.