# Logstash query to elastic

**URL:** <https://discuss.elastic.co/t/logstash-query-to-elastic/248205>\
**Category:** Logstash\
**Created:** [September 10, 2020, 4:27pm UTC](https://discuss.elastic.co/t/logstash-query-to-elastic/248205 "2020-09-10T16:27:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![FDO](https://avatars.discourse-cdn.com/v4/letter/f/ea5d25/32.png) [@FDO](https://discuss.elastic.co/u/FDO)\
**Post date:** [September 10, 2020, 4:27pm UTC](https://discuss.elastic.co/t/logstash-query-to-elastic/248205/1 "2020-09-10T16:27:25Z")

</div>

I use [https://www.elastic.co/guide/en/logstash/current/plugins-filters-elasticsearch.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elasticsearch.html)

For **end** event I trying to find data from **first** event

```auto
          if [url] {
        elasticsearch {
          hosts => ["${ES_node01}"]
          index => "logstash-mikrotik-*"
          user => "${es_login}"
          password => "${ES_pwd}"
          sort => "@timestamp:desc"
          query => 'vpn_ip:"[src_ip]" and tags:"VPN" and action:"logged in"'
          fields => { "login" => "vpn_possible_login" }
          docinfo_fields => {
            "_id" => "document_id"
            "_index" => "document_index"
            # "login" => "vpn_possible_login"
          }
        }

```

But as result I retrived

- event even with wrong **action** field
- same wrong result for different **src\_ip**

What is the mistake in query?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 8, 2020, 4:27pm UTC](https://discuss.elastic.co/t/logstash-query-to-elastic/248205/2 "2020-10-08T16:27:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.