# Salesforce input logstash - add filter

**URL:** https://discuss.elastic.co/t/salesforce-input-logstash-add-filter/344217
**Category:** Logstash
**Created:** [October 2, 2023, 9:36am UTC](https://discuss.elastic.co/t/salesforce-input-logstash-add-filter/344217 "2023-10-02T09:36:13Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Samuele\_Lolli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samuele_lolli/32/107848_2.png) [@Samuele\_Lolli](https://discuss.elastic.co/u/Samuele_Lolli)
#### Post date: [October 2, 2023, 9:36am UTC](https://discuss.elastic.co/t/salesforce-input-logstash-add-filter/344217/1 "2023-10-02T09:36:13Z")

</div>

I have a input configuration like that and i wonder if is possible to filter document like with a query or something like that.

```auto
salesforce{    
        use_test_sandbox => true
        client_id => ''    
        client_secret => ''   
        username => ''    
        password => ''        
        sfdc_object_name => 'SetupAuditTrail'
        sfdc_fields => ['Id','Action']
        security_token => ''
    }

```

Thanks in advance

---

<div class="post-metadata">

### Author: ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)
#### Post date: [October 2, 2023, 12:59pm UTC](https://discuss.elastic.co/t/salesforce-input-logstash-add-filter/344217/2 "2023-10-02T12:59:28Z")

</div>

Hi @Samuele_Lolli,

What find of filtering/processing would you like to do? You should be able to specify [filters under the `processors`](https://www.elastic.co/guide/en/logstash/current/filter-plugins.html) option to apply to the data from Salesforce.

---

<div class="post-metadata">

### Author: ![Samuele\_Lolli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samuele_lolli/32/107848_2.png) [@Samuele\_Lolli](https://discuss.elastic.co/u/Samuele_Lolli)
#### Post date: [October 2, 2023, 1:14pm UTC](https://discuss.elastic.co/t/salesforce-input-logstash-add-filter/344217/3 "2023-10-02T13:14:36Z")

</div>

Hi @carly.richmond, thank you for you response.  
I prefer filter the data i want before because i want a light logstash pipeline. I know i can filter in the filter section. What i want to do is filter where the CreatedDate is equal than yesterday, but i think that's not possible.  
Thank you again 🙂

---

<div class="post-metadata">

### Author: ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)
#### Post date: [October 3, 2023, 1:38pm UTC](https://discuss.elastic.co/t/salesforce-input-logstash-add-filter/344217/4 "2023-10-03T13:38:04Z")

</div>

Thanks for confirming @Samuele_Lolli. Can you using the [`sfdc_filters`](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-salesforce.html#plugins-inputs-salesforce-sfdc_filters) option, specifying a SOQL statement?

I'm not an expert, but from [this article](https://cafeforce.com/query-records-created-today-yesterday-in-soql-salesforce/) I found it might be something like this:

`CreatedDate = YESTERDAY`.

---

<div class="post-metadata">

### Author: ![Samuele\_Lolli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samuele_lolli/32/107848_2.png) [@Samuele\_Lolli](https://discuss.elastic.co/u/Samuele_Lolli)
#### Post date: [October 5, 2023, 8:17am UTC](https://discuss.elastic.co/t/salesforce-input-logstash-add-filter/344217/5 "2023-10-05T08:17:50Z")

</div>

Thank you @carly.richmond i think that can be a solution for my problem! I will try it soon and let you know if i have more issue. Thank you again

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 2, 2023, 8:18am UTC](https://discuss.elastic.co/t/salesforce-input-logstash-add-filter/344217/6 "2023-11-02T08:18:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.