# Logstash \[elasticsearch plugin not working\]

**URL:** https://discuss.elastic.co/t/logstash-elasticsearch-plugin-not-working/106706
**Category:** Logstash
**Created:** [November 7, 2017, 2:42pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-plugin-not-working/106706 "2017-11-07T14:42:50Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Dima\_Khodan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dima_khodan/32/22720_2.png) [@Dima\_Khodan](https://discuss.elastic.co/u/Dima_Khodan)
#### Post date: [November 7, 2017, 2:42pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-plugin-not-working/106706/1 "2017-11-07T14:42:50Z")

</div>

I have a config file with elasticsearch filter.  
After I perform query inside block "query\_template":

```
{
"query": {
    "bool": {
        "must": [
           {
               "exists": {
                    "field":"correlationId"   
               }
           },
           {
               "term": {
                  "_type": {
                     "value": "log"
                  }
               }
           },
           {
               "term": {
                  "processId": {
                     "value": "${processId}"
                  }
               }
           },
           {
               "term": {
                  "threadId": {
                     "value": "${threadId}"
                  }
               }
           }
        ],
        "must_not": [
           {
               "term": {
                  "correlationId": {
                     "value": " "
                  }
               }
           }
        ]
    }
},
"size": 1}

```

I try to add the result "correlationId" from the "\_source" to the elasticsearch plugin block "fields".  
This is the part of configuration:

```
if ![correlationId] {
		elasticsearch {
			hosts => ["localhost:9200"]
			query_template => "last_correlation_id_query.json"
            fields => { "correlationId" => "additionalCorrelationId" }
		}
	}
}

```

But value from "correlationId" is not writing to new field. It's look like nothing happend in general.  
Can somebody explain wat's wrong here? Why it's not working?

Here the [link](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elasticsearch.html#plugins-filters-elasticsearch-fields) from elasticsearch plugin documentation.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 5, 2017, 2:43pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-plugin-not-working/106706/2 "2017-12-05T14:43:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.