# How can i check data of mapping field in elasticsearch with logstash
**URL:** https://discuss.elastic.co/t/how-can-i-check-data-of-mapping-field-in-elasticsearch-with-logstash/121372
**Category:** Logstash
**Created:** [February 25, 2018, 10:35am UTC](https://discuss.elastic.co/t/how-can-i-check-data-of-mapping-field-in-elasticsearch-with-logstash/121372 "2018-02-25T10:35:34Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@yaser](https://discuss.elastic.co/u/yaser)
#### Post date: [February 25, 2018, 10:35am UTC](https://discuss.elastic.co/t/how-can-i-check-data-of-mapping-field-in-elasticsearch-with-logstash/121372/1 "2018-02-25T10:35:34Z")
hi every one , can i check the duplicate username and return true or false in logstash
input part { is rabbitmq server } / username is send by json
filter { what's happen here?}
output { what's happen here? }
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 26, 2018, 8:48am UTC](https://discuss.elastic.co/t/how-can-i-check-data-of-mapping-field-in-elasticsearch-with-logstash/121372/2 "2018-02-26T08:48:02Z")
It's not clear exactly what you want to do but there's an elasticsearch filter plugin that you can use to make queries against ES.
---
### Author:  [@yaser](https://discuss.elastic.co/u/yaser)
#### Post date: [March 17, 2018, 10:18am UTC](https://discuss.elastic.co/t/how-can-i-check-data-of-mapping-field-in-elasticsearch-with-logstash/121372/3 "2018-03-17T10:18:33Z")
**yes of course and i use it , but i have not any correct output and logstash return this error**
**this is my config :**
input {
rabbitmq {
user =\> "user"
password =\> "pass"
exchange =\> "exc"
queue =\> "que"
durable =\> true
host =\> "ip address"
subscription\_retry\_interval\_seconds =\> 5
codec =\> "json"
}
}
filter {
elasticsearch {
hosts =\> ["192.168.1.6:9200","192.168.1.7:9200"]
codec =\> "json"
index =\> "test"
document\_type =\> "user"
query =\> "{"query":{"match":{"firstname": "myname1"}}}"
}
}
output {
file {
id =\> "All Input Data Logger"
path =\> "/logstash-repository/Log/rabbitmq\_debug\_events-%{+YYYY-MM-dd}"
codec =\> rubydebug
}
}
**and return this error**
[ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Something is wrong with your configuration.", :backtrace=\>
can you please tell me how can i solve this problem |?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 17, 2018, 7:36pm UTC](https://discuss.elastic.co/t/how-can-i-check-data-of-mapping-field-in-elasticsearch-with-logstash/121372/4 "2018-03-17T19:36:02Z")
> yes of course and i use it
Then why didn't you include that in your question?
> codec =\> "json"
Remove this. The elasticsearch filter doesn't have a codec option.
> query =\> "{"query":{"match":{"firstname": "myname1"}}}"
If you want to have double quotes within a double-quoted string you need to escape them, or make the string single-quoted:
```
query => '{"query":{"match":{"firstname": "myname1"}}}'
```
Next time don't truncate any error messages. If I hadn't spotted the problems I pointed out above I would've wanted to see the part after ":backtrace=\>".
---
### Author:  [@yaser](https://discuss.elastic.co/u/yaser)
#### Post date: [March 18, 2018, 5:54am UTC](https://discuss.elastic.co/t/how-can-i-check-data-of-mapping-field-in-elasticsearch-with-logstash/121372/5 "2018-03-18T05:54:04Z")
thank you so much Magnus , for the first question apologize me ,wrong task scheduling is the main reason.
for the second part i removed
> codec =\> "json"
>
> and
>
> i changed the query to this ==\>\>\>\> query =\> '{"query":{"match":{"firstname": "myname1"}}}'
**and also delete document\_type option**
**and here is the result in Logstash log :::**
> [2018-03-18T08:59:32,664][WARN][logstash.filters.elasticsearch] Failed to query elasticsearch for previous event {:index=\>"administration\_test", :query=\>"{"query":{"match":{"firstname": "myname1"}}}", :event=\>#LogStash::Event:0x3e1aaaa2, :error=\>#\ "\"myname1\" "" at line 1, column 32.\nWas expecting:\n "TO" ...\n "}],"type":"search\_phase\_execution\_exception","reason":"all shards failed","phase":"query","grouped":true,"failed\_shards":[{"shard":0,"index":"administration\_test","node":"\_RguZSByQ8yEK4br-EsDTw","reason":{"type":"query\_shard\_exception","reason":"Failed to parse query [{"query":{"match":{"firstname": "myname1"}}}]","index\_uuid":"BKRH-J4XT\_uwghXNL\_lZ3w","index":"administration\_test","caused\_by":{"type":"parse\_exception","reason":"parse\_exception: Cannot parse '{"query":{"match":{"firstname": "myname1"}}}': Encountered " \ "\"myname1\" "" at line 1, column 32.\nWas expecting:\n "TO" ...\n ","caused\_by":{"type":"parse\_exception","reason":"parse\_exception: Encountered " \ "\"myname1\" "" at line 1, column 32.\nWas expecting:\n "TO" ...\n "}}}}]},"status":400}\>}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 18, 2018, 8:51pm UTC](https://discuss.elastic.co/t/how-can-i-check-data-of-mapping-field-in-elasticsearch-with-logstash/121372/6 "2018-03-18T20:51:32Z")
Judging by the documentation you need to use the `query_template` option if you want to make a DSL query. The `query` option is for query string queries.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 15, 2018, 8:51pm UTC](https://discuss.elastic.co/t/how-can-i-check-data-of-mapping-field-in-elasticsearch-with-logstash/121372/7 "2018-04-15T20:51:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.