Hello,
I'm trying to write a logstash filter that reads from an elasticsearch index using a template. I want to check if an integer matches a value stored in an array of ints.
// incoming record
{
"id": 2
}
// query template checking if id is present in the fields `to_ids` or `from_ids`
{
"query": {
"bool": {
"should": [
{
"match": {
"to_ids": "%{[id]}"
}
},
{
"match": {
"from_ids": "%{[id]}"
}
}
]
}
}
}
// example of document it will match with
{
to_ids: [2, 44]
from_ids: [1]
}
The query works when I add it as a filter in Kibana Discover (replacing %{[id]}
with string or int values), but fails as a logstash filter. Logstash spits out this error message
Failed to query elasticsearch for previous event {:index=>"...", :error=>"[400] {"error":{"root_cause":[{"type":"query_shard_exception","reason":"failed to create query: For input string: \"%{[id]}\"","index_uuid":"FXZRQa1xTt6jQ44zbeMZvg","index":"..."}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"tenant-service-revised","node":"cUnu_wtqTBieVb9Jrgi_rw","reason":{"type":"query_shard_exception","reason":"failed to create query: For input string: \"%{[id]}\"","index_uuid":"FXZRQa1xTt6jQ44zbeMZvg","index":"...","caused_by":{"type":"number_format_exception","reason":"For input string: \"%{[id]}\""}}}]},"status":400}"}