# Not able to refine from o/p of query in logstash

**URL:** <https://discuss.elastic.co/t/not-able-to-refine-from-o-p-of-query-in-logstash/21829>\
**Category:** Elasticsearch\
**Created:** [January 26, 2015, 9:38am UTC](https://discuss.elastic.co/t/not-able-to-refine-from-o-p-of-query-in-logstash/21829 "2015-01-26T09:38:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![raj1](https://avatars.discourse-cdn.com/v4/letter/r/5fc32e/32.png) [@raj1](https://discuss.elastic.co/u/raj1)\
**Post date:** [January 26, 2015, 9:38am UTC](https://discuss.elastic.co/t/not-able-to-refine-from-o-p-of-query-in-logstash/21829/1 "2015-01-26T09:38:53Z")

</div>

I am using the below query to pull the information from logstash::

curl -XGET '\<a href="[http://logs](http://logs):xx00//\_all/\_search?pretty=true' -d '  
{  
"query": {  
"bool": {  
"must": [  
{  
"match": {  
"\_type": "pre"  
}  
},  
{  
"match": {  
"message": "MapDone"  
}  
},  
{  
"range": {  
"@timestamp": {  
"gte": "now-5m"  
}

```
            } 
        } 
    ] 
} 

```

} }'

Output ::

{ "took" : 177, "timed\_out" : false, "\_shards" : { "total" : 3225, "successful" : 3225, "failed" : 0 }, "hits" : { "total" : 1238, "max\_score" : 4.3801584, "hits" : [{ "\_index" : "fi-logstash-2015.01.21", "\_type" : "fi", "\_id" : "CORYzNPHnnQeu09A", "\_score" : 4.3801584, "\_source":{"thread\_name":"main","message":"[MapDone]\tstandards.po.poRsxWrite in 169ms","@timestamp":"2015-01-21T14:48:59.835+00:00","level":"INFO","mdc":{},"file":"fi-1-small-log.json","class":"fi.log.MapLogHandler","line\_number":"21","logger\_name":"fi.Mapper","method":"info","@version":1,"source\_host":"fi.pp","host":"prefi2","offset":"185244882","type":"prefi","tags":["instance"],"syslog\_severity\_code":5,"syslog\_facility\_code":1,"syslog\_facility":"user-level","syslog\_severity":"notice"} }

The above is only a part of the output.I am trying to get only the map name as output. When I am trying , I am getting errors.

Different sample Maps:: formats.pure.qm.fromSIP.toCSV.write in 24ms H044Grain.hub.asn.from.advanceShipNoticeWrite in 188ms H9B1honey.hub.po.fromFEDSto.purchaseOrder in 416ms HAEPrugs.hub.rsx.v7.r0.po.poFedsWrite in 231ms H4Grain2.hub.in.fromtoAPP.invoiceWrite in 110ms H2Home.v700.e4060.co.in.inFedsWrite in 108ms

I am tring to get::

1 - only mapping names ( H4Grain2.hub.in.from.invoiceWrite )  
2 - unique mappings ( something like | uniq to previous o/p )  
3 - Average of last 1 minutes mappings

Can anybody help check if this is possible. Thanks a ton in advance.

---

<div class="post-metadata">

**Author:** ![raj1](https://avatars.discourse-cdn.com/v4/letter/r/5fc32e/32.png) [@raj1](https://discuss.elastic.co/u/raj1)\
**Post date:** [January 29, 2015, 9:02am UTC](https://discuss.elastic.co/t/not-able-to-refine-from-o-p-of-query-in-logstash/21829/2 "2015-01-29T09:02:09Z")

</div>

Can anyone help me on this problem, please !

---

<div class="post-metadata">

**Author:** ![raj1](https://avatars.discourse-cdn.com/v4/letter/r/5fc32e/32.png) [@raj1](https://discuss.elastic.co/u/raj1)\
**Post date:** [February 2, 2015, 7:07pm UTC](https://discuss.elastic.co/t/not-able-to-refine-from-o-p-of-query-in-logstash/21829/3 "2015-02-02T19:07:41Z")

</div>

can some put some light on my problem. I am sorry to bump this thread again. I am not able to get any idea if we have any option that we can call another script within my logstash query to get on my requirements.

Please let me know if anything is not clear.

Thanks In advance !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:35am UTC](https://discuss.elastic.co/t/not-able-to-refine-from-o-p-of-query-in-logstash/21829/4 "2017-07-06T00:35:19Z")

</div>

Closed on July 6, 2017, 12:35am UTC