# Failed to query elasticsearch for previous event

**URL:** <https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-event/48409>\
**Category:** Logstash\
**Created:** [April 26, 2016, 9:47am UTC](https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-event/48409 "2016-04-26T09:47:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![linhntt41](https://avatars.discourse-cdn.com/v4/letter/l/94ad74/32.png) [@linhntt41](https://discuss.elastic.co/u/linhntt41)\
**Post date:** [April 26, 2016, 9:47am UTC](https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-event/48409/1 "2016-04-26T09:47:37Z")

</div>

Hi all,  
I'm using logstash 2.3 elasticsearch 2.3  
I use filter-plugin-elasticsearch to query previous event  
This is file log:  
2016-04-26 16:30:00 userA in  
2016-04-26 16:35:00 userA out  
This is file config:  
input{  
file{  
path =\>"/opt/file1.log"  
}  
}  
filter{  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{USERNAME:username} %{WORD:status}"}  
}  
if [status] == "in" {  
mutate {  
rename =\> {"timestamp" =\> "started"}  
}  
date {  
match =\>["started","yyyy-MM-dd HH:mm:ss"]  
target =\> "[started]"  
}  
}

if [status] == out{  
elasticsearch {  
hosts =\> ["localhost"]  
query =\> "status:in AND username:%{[username]}"  
fields =\> ["@timestamp","started"]  
}  
}  
ruby {  
init =\> "require 'time'"  
code =\> "event['duration\_hrs'] = Time.parse((event['ended']).to\_s).iso8601 - Time.parse((event['started']).to\_s).iso8601"  
add\_tag =\> ["duration\_hrs"]  
}  
}  
output {

```
    stdout { codec => rubydebug}
    if "_grokparsefailure" not in [tags] {
    elasticsearch { hosts => ["localhost:9200"]
                    index => "index-%{+YYYY.MM.dd}"}
     }

```

}

**Error:**  
Failed to query elasticsearch for previous event {:query=\>"status:in AND username:userA}", :event=\>#"/opt/file1.log"}, @lut={"[path]"=\>[{"path"=\>"/opt/file1.log"}, "path"]}\>, @cancelled=false, @data={"message"=\>"", "@version"=\>"1", "@timestamp"=\>"2016-04-26T02:55:43.702Z", "path"=\>"/opt/file1.log", "host"=\>"[elk.test.vn](http://elk.test.vn)", "tags"=\>["\_grokparsefailure"]}, @metadata={"path"=\>"/opt/file1.log"}, @accessors=#"", "@version"=\>"1", "@timestamp"=\>"2016-04-26T02:55:43.702Z", "path"=\>"/opt/file1.log", "host"=\>"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:55am UTC](https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-event/48409/2 "2017-07-06T04:55:05Z")

</div>