# Logstash Elasticsearch filer query to filter data from existing data

**URL:** <https://discuss.elastic.co/t/logstash-elasticsearch-filer-query-to-filter-data-from-existing-data/289304>\
**Category:** Logstash\
**Created:** [November 16, 2021, 10:52am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filer-query-to-filter-data-from-existing-data/289304 "2021-11-16T10:52:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![DeepakStile](https://avatars.discourse-cdn.com/v4/letter/d/e79b87/32.png) [@DeepakStile](https://discuss.elastic.co/u/DeepakStile)\
**Post date:** [November 16, 2021, 10:52am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filer-query-to-filter-data-from-existing-data/289304/1 "2021-11-16T10:52:31Z")

</div>

I am trying to add existing data from Elasticsearch index to a current event of logstash using Elasticsearch filter

current logstash event is

id,status,date  
123456789,ByMobile,Success

Existing Data like

id,status,date  
123456789,created,10-11-2020 14:12:33  
123456789,pending,10-11-2020 14:12:34  
123456789,completed,10-11-2020 14:12:35

now i want above to add above 3 records info to the present event by matching with current event feild id = existing data field id

i tried

lasticsearch {  
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]  
index =\> "elasticsearchdataindex11"  
query =\> "id : %{[id]}"  
fields =\> {  
"id" =\> "ID"  
"status" =\> "STATUS"  
"date" =\> "DATE"  
}  
}

is it correct?

also i tried querytemplte

{  
"query": {  
"query\_string": {  
"query": "VIN": %{[VIN]}  
}  
}  
,  
"\_source": ["id","status","date"]  
}

but iam getting an error like

Failed to query Elasticsearch for previous event {:index=\>"elasticsearchdataindex11", :error=\>"Unexpected character (':' (code 58)): was expecting comma to separate Object entries\n at [Source: (byte)"{\r\n "query": {\r\n "query\_string": {\r\n "query": "id": 123456789\r\n }\r\n }\r\n ,\r\n "\_source": ["id","status","date"]\r\n}"; line: 4, column: 22]"}

can anyone help on this, Thanks

---

<div class="post-metadata">

**Author:** ![DeepakStile](https://avatars.discourse-cdn.com/v4/letter/d/e79b87/32.png) [@DeepakStile](https://discuss.elastic.co/u/DeepakStile)\
**Post date:** [November 16, 2021, 11:02am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filer-query-to-filter-data-from-existing-data/289304/2 "2021-11-16T11:02:38Z")

</div>

Also I this in template.json  
{  
"query":{  
"bool": {  
"should": [  
{  
"match": {  
"id": "%{[id]}"  
}  
}  
]  
}  
}  
}

but getting an error like

Ruby exception occurred: undefined local variable or method `null' for #LogStash::Filters::Ruby:0x4aadbb56 {:class=\>"NameError",

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 14, 2021, 11:02am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filer-query-to-filter-data-from-existing-data/289304/3 "2021-12-14T11:02:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.