# Elasticsearch percolator and Logstash ... How to?
**URL:** https://discuss.elastic.co/t/elasticsearch-percolator-and-logstash-how-to/21107
**Category:** Elasticsearch
**Created:** [December 5, 2014, 3:02pm UTC](https://discuss.elastic.co/t/elasticsearch-percolator-and-logstash-how-to/21107 "2014-12-05T15:02:39Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Thorsten\_Nickel](https://discuss.elastic.co/u/Thorsten_Nickel)
#### Post date: [December 5, 2014, 3:02pm UTC](https://discuss.elastic.co/t/elasticsearch-percolator-and-logstash-how-to/21107/1 "2014-12-05T15:02:39Z")
Dear all,
this is my first post to this group, since any more googling does not
result in any more results, this looks like my last hope.
Regarding my problem, I have an ELK Stack up and running. My logstasher
sits on system logs, grok's them as I want them to, and puts these
informations
via the elasticsearch output plugin into ES. Using Kibana Frontend, I can
see my Loglines flowing in, and everything is good.
Now for my scenario, I would like to have some form of basic 'alerting' put
into this chain. For this, I put up a percolator query into ES.
If I use CURL to ask with this percolator, I get my result like this :
curl -XGET
'127.0.0.1:9200/logstash-2014.12.05/MONITOR/AUoaylhicoeQR6lWzrbU/\_percolate?pretty'
{
"took" : 38,
"\_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"total" : 1,
"matches" : [ {
"\_index" : "logstash-2014.12.05",
"\_id" : "monitor\_red"
} ]
}
The point is, I kinda need to do this percolator query, when I put my Doc
into ES using logstash so I can see, if it triggers the percolator query or
not. Or another point would be, if I have like
thousands of docs in ES, how would I percolate through all of them to see,
which ones match the monitor\_red query?
As far as I can see, I need to query with the percolator one doc at a
time.... looks really cumbersome to me.
I hope that I explained my problem good enough.
Kind regards,
T. Nickel
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/8a422d3a-2d8a-4bb3-9e2d-a78dff154c2a%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/8a422d3a-2d8a-4bb3-9e2d-a78dff154c2a%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Jay\_Swan](https://discuss.elastic.co/u/Jay_Swan)
#### Post date: [December 5, 2014, 3:32pm UTC](https://discuss.elastic.co/t/elasticsearch-percolator-and-logstash-how-to/21107/2 "2014-12-05T15:32:39Z")
Logstash doesn't support the percolator API today.
On Friday, December 5, 2014 8:02:39 AM UTC-7, Thorsten Nickel wrote:
> Dear all,
>
> this is my first post to this group, since any more googling does not
> result in any more results, this looks like my last hope.
>
> Regarding my problem, I have an ELK Stack up and running. My logstasher
> sits on system logs, grok's them as I want them to, and puts these
> informations
> via the elasticsearch output plugin into ES. Using Kibana Frontend, I can
> see my Loglines flowing in, and everything is good.
>
> Now for my scenario, I would like to have some form of basic 'alerting'
> put into this chain. For this, I put up a percolator query into ES.
> If I use CURL to ask with this percolator, I get my result like this :
>
> curl -XGET '
> 127.0.0.1:9200/logstash-2014.12.05/MONITOR/AUoaylhicoeQR6lWzrbU/\_percolate?pretty
> '
> {
> "took" : 38,
> "\_shards" : {
> "total" : 5,
> "successful" : 5,
> "failed" : 0
> },
> "total" : 1,
> "matches" : [ {
> "\_index" : "logstash-2014.12.05",
> "\_id" : "monitor\_red"
> } ]
> }
>
> The point is, I kinda need to do this percolator query, when I put my Doc
> into ES using logstash so I can see, if it triggers the percolator query or
> not. Or another point would be, if I have like
> thousands of docs in ES, how would I percolate through all of them to see,
> which ones match the monitor\_red query?
>
> As far as I can see, I need to query with the percolator one doc at a
> time.... looks really cumbersome to me.
>
> I hope that I explained my problem good enough.
>
> Kind regards,
> T. Nickel
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/5de53375-4078-4f98-bbfc-4b3fe2c0f485%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/5de53375-4078-4f98-bbfc-4b3fe2c0f485%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@val](https://discuss.elastic.co/u/val)
#### Post date: [May 4, 2016, 9:11am UTC](https://discuss.elastic.co/t/elasticsearch-percolator-and-logstash-how-to/21107/3 "2016-05-04T09:11:27Z")
There was a similar need reported [here](https://discuss.elastic.co/t/how-to-use-percolator-while-indexing-the-document-using-logstash-pre-processing/24554/2?u=val) and I answered there.
Such a Logstash filter now exists, it has not been released on RubyGems but you can easily build it and install it.
---
### Author:  [@tomx1](https://discuss.elastic.co/u/tomx1)
#### Post date: [November 25, 2016, 2:38pm UTC](https://discuss.elastic.co/t/elasticsearch-percolator-and-logstash-how-to/21107/4 "2016-11-25T14:38:07Z")
I have exactly the same problem. The perculator filter is stil not included in logstash... Is there a way to perculate with logstash \<\> elasticsearch in 5.x?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 10:05pm UTC](https://discuss.elastic.co/t/elasticsearch-percolator-and-logstash-how-to/21107/5 "2017-07-05T22:05:26Z")