How to query elasticsearch with array as parameter

Elastic Stack Logstash
1

I have a logstash config like this

input { http { port => 8092 } }

filter {
	ruby {
		code => '
			event.set("[@metadata][leadArr]", [])
			c = event.get("[@metadata][leads]")
			c.each { |value, index|
				temp = event.get("[@metadata][leadArr]") << value["lead"]
				event.set("[@metadata][leadArr]", temp)
			}
		'
	}

	elasticsearch {
		hosts => ["${ES_ADDRESS}"]
		index => "myindex"
		query_template => "/queries/abc.json"
		fields => {
			"resource" => "[@metadata][leadss]"
		}
	}

	ruby { code => 'event.set("[@metadata][attributes][leadsss]", [ event.get("[@metadata][leadss]") ])' }

}

output {
	elasticsearch {
		hosts => ["${ES_ADDRESS}"]
		index => "ci-customer"
		document_id => "%{[@metadata][id]}"
	}
    #   stdout { }
	stdout { codec => rubydebug { metadata => true }}
}

and with query template abc.json

{
    "size": 100,
	"query" : {
		"terms" : {
			"resource.name" : ["%{[@metadata][leadArr]}"]
		}
	}
 }

My problem is, whenever [@metadata][leadArr] has a value, the result will be as expected, but when leadArr has 2 or more values, the result will return empty. How do I fix this template ?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.