# Logstash "Duplicate field 'match'

**URL:** <https://discuss.elastic.co/t/logstash-duplicate-field-match/278524>\
**Category:** Logstash\
**Created:** [July 13, 2021, 10:42am UTC](https://discuss.elastic.co/t/logstash-duplicate-field-match/278524 "2021-07-13T10:42:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sahere37](https://avatars.discourse-cdn.com/v4/letter/s/b2d939/32.png) [@sahere37](https://discuss.elastic.co/u/sahere37)\
**Post date:** [July 13, 2021, 10:42am UTC](https://discuss.elastic.co/t/logstash-duplicate-field-match/278524/1 "2021-07-13T10:42:39Z")

</div>

Hi all  
I am using following input in logstash conf file to checking matching of a field.

```auto
input {
elasticsearch {
hosts => ["http://localhost:9200/"]
index => "log*"
query => '{
		"query": { 
		      "bool" : {
		          "must" : {
		                "match": { "request.type": "1"},
		                "match": { "request.type": "2"}

		             },
				   "filter" : { 
                        "range" : { "timestamp" : { "gte": "now-1d/d", "lte": "now-1d/d"}} 
				   }
		      }

		}, 
		"sort": ["_doc"] 
	}'
}
 exec { command => "/bin/true" interval => 864000 } 
}

```

but running it leading to following error in logstash and cannot be started:

` Error: [500] {"error":{"root_cause":[{"type":"json_parse_exception","reason":"Duplicate field 'match'\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@4770f542; line: 6, column: 26]"}],"type":"json_parse_exception","reason":"Duplicate field 'match'\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@4770f542; line: 6, column: 26]"},"status":500}`

actually i want to filter events that their request.type field value is 1 or 2.  
any help will be so appreciated

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 10, 2021, 10:42am UTC](https://discuss.elastic.co/t/logstash-duplicate-field-match/278524/2 "2021-08-10T10:42:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.