Logstash elasticsearch filter and array of string substitution

[Silver137]

I'm using the logstash elasticsearch filter to make a terms query where i need to substitute an array on the selected query_template.

The query template is as follows:

{
  "size": 5,
  "query": {
    "bool": {"filter": [
      {"range": { "@timestamp": { "gte": "now-1w/d", "lte": "now/d"}}},
      {"terms": {
        "product": ["%{[product_list]}"]
      }}
    ]}
  }
}

Where product list is a variable with a list of string that must be expanded to acomplish the query dsl format.

Well the query dosen't work.

I have already try indicating the postion on the array and works perfectly:

"product": ["%{[product_list][0]}"]

and

"product": ["%{[product_list][1]}"]

works.

But i need to expand the array to pass the list of string to do the terms query.

[Silver137]

One of the posible workarounds consist of usege of a previous mutate filter usage:

mutate { join => {"ip_list" => '","'} }

This separetes the strings of the array on the correct way for include in the json query.
But it's interesting find a cleaner solution.