# Logstash elasticsearch filter and array of string substitution
**URL:** https://discuss.elastic.co/t/logstash-elasticsearch-filter-and-array-of-string-substitution/308646
**Category:** Logstash
**Created:** [July 1, 2022, 9:46am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-and-array-of-string-substitution/308646 "2022-07-01T09:46:06Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Silver137](https://discuss.elastic.co/u/Silver137)
#### Post date: [July 1, 2022, 9:46am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-and-array-of-string-substitution/308646/1 "2022-07-01T09:46:06Z")
I'm using the logstash elasticsearch filter to make a terms query where i need to substitute an array on the selected query\_template.
The query template is as follows:
```auto
{
"size": 5,
"query": {
"bool": {"filter": [
{"range": { "@timestamp": { "gte": "now-1w/d", "lte": "now/d"}}},
{"terms": {
"product": ["%{[product_list]}"]
}}
]}
}
}
```
Where product list is a variable with a list of string that must be expanded to acomplish the query dsl format.
Well the query dosen't work.
I have already try indicating the postion on the array and works perfectly:
```auto
"product": ["%{[product_list][0]}"]
```
and
```auto
"product": ["%{[product_list][1]}"]
```
works.
But i need to expand the array to pass the list of string to do the terms query.
---
### Author:  [@Silver137](https://discuss.elastic.co/u/Silver137)
#### Post date: [July 1, 2022, 11:01am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-and-array-of-string-substitution/308646/2 "2022-07-01T11:01:45Z")
One of the posible workarounds consist of usege of a previous mutate filter usage:
```auto
mutate { join => {"ip_list" => '","'} }
```
This separetes the strings of the array on the correct way for include in the json query.
But it's interesting find a cleaner solution.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 29, 2022, 11:02am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-and-array-of-string-substitution/308646/3 "2022-07-29T11:02:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.