# Failed to query elasticsearch for previous even

**URL:** <https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-even/46822>\
**Category:** Logstash\
**Created:** [April 8, 2016, 3:36pm UTC](https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-even/46822 "2016-04-08T15:36:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\
**Post date:** [April 8, 2016, 3:36pm UTC](https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-even/46822/1 "2016-04-08T15:36:07Z")

</div>

Hi,  
I'm using logstash 2.3.0, we are using elastisearch correlation in my config file. While processing facing issue on correlation and its throwing below error,  
\<TypeError: can't convert nil into String\>, :level=\>:warn}  
Failed to query elasticsearch for previous event {:query=\>"type:vehicle\_log AND vehicle\_modelNumber:\"6948\" AND vehicle\_modelYear:\"2016\"v AND vehicle\_phaseCode:\"G\"", :event=\>2016-04-08T15:30:06.406Z \<s:Envelope xmlns:s="[http://schemas.xmlsoap.org/soap/envelope/](http://schemas.xmlsoap.org/soap/envelope/)"\>

This is my correlation:  
elasticsearch {  
hosts =\> ["[http://xx.xx.xx.xx:9200](http://xx.xx.xx.xx:9200)"]  
query =\> "type:dealer\_log AND dlr\_dlrCode:"%{[dlr\_tradefrm\_dlrno]}""   
fields =\> [  
"dlr\_dlrCode","dlr\_tradefrm\_dlrno",  
"dlr\_dlrCountryCode","dlr\_tradefrm\_country",  
"dlr\_dlrRegionAbbr","dlr\_tradefrm\_regionName"   
]  
#fail\_on\_error =\> "false"   
}

Im trying to correlate the field from existing index to current processing index. Please help us to resolve it.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 9, 2016, 7:17am UTC](https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-even/46822/2 "2016-04-09T07:17:24Z")

</div>

Is there anything in the ES logs at the same time?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-even/46822/3 "2017-07-06T05:03:04Z")

</div>