# How to set the period at which the Elasticsearch filter in logstash

**URL:** <https://discuss.elastic.co/t/how-to-set-the-period-at-which-the-elasticsearch-filter-in-logstash/185076>\
**Category:** Logstash\
**Created:** [June 11, 2019, 12:28am UTC](https://discuss.elastic.co/t/how-to-set-the-period-at-which-the-elasticsearch-filter-in-logstash/185076 "2019-06-11T00:28:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yungyoung\_Ok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yungyoung_ok/32/43465_2.png) [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\
**Post date:** [June 11, 2019, 12:28am UTC](https://discuss.elastic.co/t/how-to-set-the-period-at-which-the-elasticsearch-filter-in-logstash/185076/1 "2019-06-11T00:28:42Z")

</div>

I'd like to set the period at which the Elasticsearch filter in logstash flies the query.

When data is received through the input, the value of the id field is dropped into the query to obtain the name corresponding to the id from the existing index.

The problem is that the filter runs the query at a slower rate, periodically the result(dashboard field) is displayed as nil.

How do we solve this problem?

Here is my code..

elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> ".kibana"  
query =\> "\_id:/dashboard?/%{[args][objects][id]}"  
fields =\> {"dashboard" =\> "dashboard"}  
enable\_sort =\> false  
}

mutate {  
add\_field =\> {  
"title" =\> "%{[dashboard][title]}"  
}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 11, 2019, 12:31am UTC](https://discuss.elastic.co/t/how-to-set-the-period-at-which-the-elasticsearch-filter-in-logstash/185076/2 "2019-06-11T00:31:56Z")

</div>

Have you seen [https://www.elastic.co/guide/en/logstash/current/plugins-inputs-elasticsearch.html#\_scheduling](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-elasticsearch.html#_scheduling)?

---

<div class="post-metadata">

**Author:** ![Yungyoung\_Ok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yungyoung_ok/32/43465_2.png) [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\
**Post date:** [June 11, 2019, 1:03am UTC](https://discuss.elastic.co/t/how-to-set-the-period-at-which-the-elasticsearch-filter-in-logstash/185076/3 "2019-06-11T01:03:59Z")

</div>

I want to use query in filter instead of input.

This is because we want to create a query condition with data that has been read into the file bit, and we want to fetch only one data that satisfies the condition.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 11, 2019, 1:08am UTC](https://discuss.elastic.co/t/how-to-set-the-period-at-which-the-elasticsearch-filter-in-logstash/185076/4 "2019-06-11T01:08:34Z")

</div>

Oh sorry, you can't do that. I thought there was an enhancement request for this [in the repo](https://github.com/logstash-plugins/logstash-filter-elasticsearch/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc) but I can't see one, so it might be best to raise one 🙂

---

<div class="post-metadata">

**Author:** ![Yungyoung\_Ok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yungyoung_ok/32/43465_2.png) [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\
**Post date:** [June 11, 2019, 1:28am UTC](https://discuss.elastic.co/t/how-to-set-the-period-at-which-the-elasticsearch-filter-in-logstash/185076/5 "2019-06-11T01:28:33Z")

</div>

It's really sad.  
Is there any other way to join the data in the Elastic Search and the collected data?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2019, 1:28am UTC](https://discuss.elastic.co/t/how-to-set-the-period-at-which-the-elasticsearch-filter-in-logstash/185076/6 "2019-07-09T01:28:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.