Logstash [elasticsearch plugin not working]

I have a config file with elasticsearch filter.
After I perform query inside block "query_template":

{
"query": {
    "bool": {
        "must": [
           {
               "exists": {
                    "field":"correlationId"   
               }
           },
           {
               "term": {
                  "_type": {
                     "value": "log"
                  }
               }
           },
           {
               "term": {
                  "processId": {
                     "value": "${processId}"
                  }
               }
           },
           {
               "term": {
                  "threadId": {
                     "value": "${threadId}"
                  }
               }
           }
        ],
        "must_not": [
           {
               "term": {
                  "correlationId": {
                     "value": " "
                  }
               }
           }
        ]
    }
},
"size": 1}

I try to add the result "correlationId" from the "_source" to the elasticsearch plugin block "fields".
This is the part of configuration:

if ![correlationId] {
		elasticsearch {
			hosts => ["localhost:9200"]
			query_template => "last_correlation_id_query.json"
            fields => { "correlationId" => "additionalCorrelationId" }
		}
	}
}

But value from "correlationId" is not writing to new field. It's look like nothing happend in general.
Can somebody explain wat's wrong here? Why it's not working?

Here the link from elasticsearch plugin documentation.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.