# \[Logstash\] elasticsearch filter error on mark logs
**URL:** https://discuss.elastic.co/t/logstash-elasticsearch-filter-error-on-mark-logs/261293
**Category:** Logstash
**Created:** [January 15, 2021, 7:33pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-error-on-mark-logs/261293 "2021-01-15T19:33:22Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Joao\_Palma](https://discuss.elastic.co/u/Joao_Palma)
#### Post date: [January 15, 2021, 7:33pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-error-on-mark-logs/261293/1 "2021-01-15T19:33:22Z")
Hello,
I have two pipeline one main, listen filebeat and put data in elastic, and other with post process, the input is elastic, have one elastic filter (bellow), and put back data in elastic with updates.
The main goal of post process is know what is the most recent log, and for that I use filter lower than timestamp and process id.
My elastic filter in second pipeline is:
```auto
elasticsearch {
add_tag => ["obsoleteLogs"]
hosts => "elasticsearch:9200"
index => ["filebeat-*"]
query_template => "/markObsoleteLogs.json"
}
```
And my file with query (markObsoleteLogs.json) is
```auto
{
"size": 200,
"query": {
"bool": {
"must": [],
"filter": [
{
"bool": {
"must_not": [
{
"match_phrase": {
"tags.keyword": "obsoleteLogs"
}
}
],
"should": [
{
"match_phrase": {
"@message.processInstId.keyword": "%{[processInstId]}"
}
},
{
"range": {
"timestamp": {
"lt": "%{[timestamp]}"
}
}
}
],
"minimum_should_match": 2
}
}
]
}
}
}
```
But as result I don't have the most recent log as you can see, here:
```auto
{"timestamp": "2021-01-15T19:04:45.815Z", "var_Qwerty": { "numero": "57354", "name:"abc"}, "processInstId": "512d1aa9568d11eb94640242ac120004", "tags": ["LogWithVars", "obsoleteLogs"], ...}
{"timestamp": "2021-01-15T19:04:45.140Z", "var_Qwerty": { "numero": "57354"}, "processInstId": "512d1aa9568d11eb94640242ac120004", "tags": ["LogWithVars"], ...}
```
The first is more recent but is marked with obsoleteLogs... You know what is the problem?
Thanks,
João
---
### Author:  [@Joao\_Palma](https://discuss.elastic.co/u/Joao_Palma)
#### Post date: [January 17, 2021, 6:28pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-error-on-mark-logs/261293/2 "2021-01-17T18:28:01Z")
nobody? @Badger @Leslie_Hawthorn, can you help me? please
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 17, 2021, 6:47pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-error-on-mark-logs/261293/3 "2021-01-17T18:47:37Z")
You are asking what query you should run in elasticsearch to find a particular document. That is an elasticsearch question, not a logstash question.
---
### Author:  [@Joao\_Palma](https://discuss.elastic.co/u/Joao_Palma)
#### Post date: [January 17, 2021, 8:25pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-error-on-mark-logs/261293/4 "2021-01-17T20:25:29Z")
@Badger thanks for the answer but I tested the query in dev tools and works good!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 14, 2021, 8:25pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-error-on-mark-logs/261293/5 "2021-02-14T20:25:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.