# Logstash Filter - Elasticserach Query
**URL:** https://discuss.elastic.co/t/logstash-filter-elasticserach-query/110210
**Category:** Logstash
**Created:** [December 4, 2017, 8:29pm UTC](https://discuss.elastic.co/t/logstash-filter-elasticserach-query/110210 "2017-12-04T20:29:14Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@arnydo](https://discuss.elastic.co/u/arnydo)
#### Post date: [December 4, 2017, 8:29pm UTC](https://discuss.elastic.co/t/logstash-filter-elasticserach-query/110210/1 "2017-12-04T20:29:15Z")
Good afternoon,
I am working on a Logstash filter and am in need of assitance.
Basically, I have two indexes; one is a list of known malware domains (domainlist) and another is an index of DNS queries fed by Packetbeat.
As the DNS logs hit Logstash I want LS to query ES and see if the query matches any domains listed in the "domainlist" index. If is does, I want it to add the tag "malware."
Here is what I have so far. Now, this filter simply adds the tag to all "DNS" types. How do I say "if ES query returns "true", add tag ...."
if [type] == "dns" {
elasticsearch {
hosts =\> "elasticsearch:9200"
index =\> "domainlist"
query =\> "domain:%{resource}"
add\_tag =\> ["malware","[malwaredomainlist.com](http://malwaredomainlist.com)"]
}
Thanks in advance!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 1, 2018, 8:29pm UTC](https://discuss.elastic.co/t/logstash-filter-elasticserach-query/110210/2 "2018-01-01T20:29:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.