# Logstash filter plugin elasticsearch problem

**URL:** https://discuss.elastic.co/t/logstash-filter-plugin-elasticsearch-problem/111106
**Category:** Logstash
**Created:** [December 11, 2017, 1:51pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-elasticsearch-problem/111106 "2017-12-11T13:51:20Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![rromanovic](https://avatars.discourse-cdn.com/v4/letter/r/fbc32d/32.png) [@rromanovic](https://discuss.elastic.co/u/rromanovic)
#### Post date: [December 11, 2017, 1:51pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-elasticsearch-problem/111106/1 "2017-12-11T13:51:20Z")

</div>

Hi,  
my configuration is as follows:

input {  
beats {  
port =\> "5043"  
}  
}

filter {  
if [message] =~ /IDRequestType [Varchar2 \d+] = '([A-Z\_]_)'/ {  
grok {  
match =\> ["message", "(?\<procedure\>\S_)\s(?\<taskTag\>[0-9a-f]{32})\s_IN: actionType [Varchar2 \d+] = '(?\<actionType\>\w+)'\s_OUT: IDRequestType [Varchar2 \d+] = '(?\<idRequestType\>\w+)'"]  
}  
} else {  
grok {  
match =\> ["message", "(?\<procedura\>\S\*)\s(?\<taskTag\>[0-9a-f]{32})\sIN: IDRequestState [Varchar2 \d+] = '(?\<idRequestState\>[A-Z])'"]  
}

```
elasticsearch {
  index => "indexname"
  query => 'taskTag:"%{[taskTag]}"'
  fields => {"idRequestType" => "idRequestType"}
  sort => "idRequestType.keyword:desc"
}

```

}  
}

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> "indexname"  
}  
}

But it seems that querying is not working for every event. I get output like this:

{  
"\_index": "indexname",  
"taskTag": "b5feaf378733493c953fbca7d0a53e92",  
"source": "/home/elk/logovi/Trace-2017-10-31-19.log",  
"message": "Mw.Common.Database b5feaf378733493c953fbca7d0a53e92 IN: RequestState [Varchar2 3] = 'C'",  
"type": "log",  
"tags": [  
"beats\_input\_codec\_plain\_applied"  
],  
"@timestamp": "2017-12-11T13:28:14.244Z",  
"idRequestState": "C",  
"procedure": "Com.IGT.Mw.Common.Database.DbAccess+DbTxn.Execute",  
"@version": "1",  
}  
}

and

{  
"\_index": "indexname",  
"taskTag": "a480a751d8ae4eaaa454ca0156f031c9",  
"source": "/home/elk/logovi/Trace-2017-10-31-16.log",  
"message": "Mw.Common.Database a480a751d8ae4eaaa454ca0156f031c9 IN: IDRequestState [Varchar2 3] = 'C'",  
"type": "log",  
"tags": [  
"beats\_input\_codec\_plain\_applied"  
],  
"@timestamp": "2017-12-11T13:28:14.245Z",  
"idRequestState": "C",  
"procedura": "Mw.Common.Database",  
"@version": "1",  
**"idRequestType": "CASH\_HQ"**  
}

As you can see once it looks like elasticsearch query has run as it should, but once it somehow fails. I cannot see anything in logs, no errors, no warnings...

Does anyone have any idea where I am wrong?

Thank you!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 8, 2018, 1:51pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-elasticsearch-problem/111106/2 "2018-01-08T13:51:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.