# Number\_format\_exception: Elasticsearch Query Template - check if value of int field present inside array\[int\] field

**URL:** https://discuss.elastic.co/t/number-format-exception-elasticsearch-query-template-check-if-value-of-int-field-present-inside-array-int-field/244220
**Category:** Logstash
**Created:** [August 7, 2020, 8:12pm UTC](https://discuss.elastic.co/t/number-format-exception-elasticsearch-query-template-check-if-value-of-int-field-present-inside-array-int-field/244220 "2020-08-07T20:12:04Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![tinhn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tinhn/32/73530_2.png) [@tinhn](https://discuss.elastic.co/u/tinhn)
#### Post date: [August 7, 2020, 8:12pm UTC](https://discuss.elastic.co/t/number-format-exception-elasticsearch-query-template-check-if-value-of-int-field-present-inside-array-int-field/244220/1 "2020-08-07T20:12:04Z")

</div>

Hello,

I'm trying to write a logstash filter that reads from an elasticsearch index using a template. I want to check if an integer matches a value stored in an array of ints.

```auto
// incoming record
{
  "id": 2
}

// query template checking if id is present in the fields `to_ids` or `from_ids`
{
  "query": {
    "bool": {
      "should": [
        {
           "match": {
               "to_ids": "%{[id]}"
            }
        },
        {
           "match": {
               "from_ids": "%{[id]}"
            }
        }
      ]
    }
  }
}

// example of document it will match with
{
  to_ids: [2, 44]
  from_ids: [1]
}

```

The query works when I add it as a filter in Kibana Discover (replacing `%{[id]}` with string or int values), but fails as a logstash filter. Logstash spits out this error message

Failed to query elasticsearch for previous event {:index=\>"...", :error=\>"[400] {"error":{"root\_cause":[{"type":"query\_shard\_exception","reason":"failed to create query: For input string: \"%{[id]}\"","index\_uuid":"FXZRQa1xTt6jQ44zbeMZvg","index":"..."}],"type":"search\_phase\_execution\_exception","reason":"all shards failed","phase":"query","grouped":true,"failed\_shards":[{"shard":0,"index":"tenant-service-revised","node":"cUnu\_wtqTBieVb9Jrgi\_rw","reason":{"type":"query\_shard\_exception","reason":"failed to create query: For input string: \"%{[id]}\"","index\_uuid":"FXZRQa1xTt6jQ44zbeMZvg","index":"...","caused\_by":{"type":"number\_format\_exception","reason":"For input string: \"%{[id]}\""}}}]},"status":400}"}

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 7, 2020, 9:18pm UTC](https://discuss.elastic.co/t/number-format-exception-elasticsearch-query-template-check-if-value-of-int-field-present-inside-array-int-field/244220/2 "2020-08-07T21:18:37Z")

</div>

Are you using a filter to query elasticsearch? What does the filter configuration look like?

The error message comes from elasticsearch, which means that logstash did not interpolate the value of the [id] field (which it [tries to](https://github.com/logstash-plugins/logstash-filter-elasticsearch/blob/61a531336fde2a8e6745e2497c9ff918544509d8/lib/logstash/filters/elasticsearch.rb#L125) for both templates and query strings.). That very much suggests that the [id] field does not exist.

---

<div class="post-metadata">

### Author: ![tinhn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tinhn/32/73530_2.png) [@tinhn](https://discuss.elastic.co/u/tinhn)
#### Post date: [August 10, 2020, 6:07pm UTC](https://discuss.elastic.co/t/number-format-exception-elasticsearch-query-template-check-if-value-of-int-field-present-inside-array-int-field/244220/3 "2020-08-10T18:07:44Z")

</div>

Hello @Badger,

Thanks for your response. Yes, I'm using the elasticsearch filter plugin. I set up my filter like so (just adding some fields when I see a match).

```auto
elasticsearch {
  id => "example-filter"
  hosts => ["http://localhost:9200"]
  index => "example-index"
  query_template => "<PATH_TO_TEMPLATE>/example.template.json"
  fields => {
    "description" => "user.service_description"
    "name" => "user.name"
  }
  enable_sort => false
}

```

I checked that the `id` field exists by outputting to stdout.

I believe the error is caused when using the match operation with a field type int instead of string when using query templates. To verify this, I added a filter to convert the `id` field from int --\> string and referenced the string field in my template. This change works despite matching against an array of ints. Weirdly enough, adding the query as a filter via Kibana Discover also works when setting id as int AND string.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 7, 2020, 6:07pm UTC](https://discuss.elastic.co/t/number-format-exception-elasticsearch-query-template-check-if-value-of-int-field-present-inside-array-int-field/244220/4 "2020-09-07T18:07:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
