# How to query elasticsearch with array as parameter

**URL:** https://discuss.elastic.co/t/how-to-query-elasticsearch-with-array-as-parameter/339991
**Category:** Logstash
**Created:** [August 3, 2023, 3:23am UTC](https://discuss.elastic.co/t/how-to-query-elasticsearch-with-array-as-parameter/339991 "2023-08-03T03:23:50Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![rae93](https://avatars.discourse-cdn.com/v4/letter/r/e19b73/32.png) [@rae93](https://discuss.elastic.co/u/rae93)
#### Post date: [August 3, 2023, 3:23am UTC](https://discuss.elastic.co/t/how-to-query-elasticsearch-with-array-as-parameter/339991/1 "2023-08-03T03:23:50Z")

</div>

I have a logstash config like this

```auto
input { http { port => 8092 } }

filter {
	ruby {
		code => '
			event.set("[@metadata][leadArr]", [])
			c = event.get("[@metadata][leads]")
			c.each { |value, index|
				temp = event.get("[@metadata][leadArr]") << value["lead"]
				event.set("[@metadata][leadArr]", temp)
			}
		'
	}

	elasticsearch {
		hosts => ["${ES_ADDRESS}"]
		index => "myindex"
		query_template => "/queries/abc.json"
		fields => {
			"resource" => "[@metadata][leadss]"
		}
	}

	ruby { code => 'event.set("[@metadata][attributes][leadsss]", [event.get("[@metadata][leadss]") ])' }

}

output {
	elasticsearch {
		hosts => ["${ES_ADDRESS}"]
		index => "ci-customer"
		document_id => "%{[@metadata][id]}"
	}
    # stdout { }
	stdout { codec => rubydebug { metadata => true }}
}

```

and with query template `abc.json`

```auto
{
    "size": 100,
	"query" : {
		"terms" : {
			"resource.name" : ["%{[@metadata][leadArr]}"]
		}
	}
 }

```

My problem is, whenever `[@metadata][leadArr]` has a value, the result will be as expected, but when leadArr has 2 or more values, the result will return empty. How do I fix this template ?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 31, 2023, 3:24am UTC](https://discuss.elastic.co/t/how-to-query-elasticsearch-with-array-as-parameter/339991/2 "2023-08-31T03:24:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.