title: Using Elasticsearch filter in logstash
body: <p>I'm trying to use the elastic search filter on logstash for make some Data Enrichment.</p>
  <p>I got two indexes, and my goal it's get some data from one of them and add it to the other.</p>
  <p>I configured a logstash filter who search in my elasticsearch and if there is a match the output goes to the index.</p>
  <p>But my filter it's not working propery because when I test the filter i got this error</p>
  <pre><code>[WARN ] 2020-10-02 19:23:09.536 [[main]&gt;worker2] elasticsearch - Failed to query elasticsearch for previous event {:index=&gt;&quot;logstash-*&quot;, :error=&gt;&quot;Unexpected character ('%' (code 37)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')\n
  </code></pre>
  <p>I think there it's some issue between the variable in the template and the elastic search</p>
  <p>my logstash it's a 7.3.2 and my ES an 7.4.2</p>
  <p>here it's my settings</p>
  <pre><code>
         Logstash.conf
          
         input {
                 http{ }
         }
          
         filter {
                 elasticsearch {
                   hosts =&gt; [&quot;127.0.0.1:9200&quot;]
                   index =&gt; &quot;logstash-*&quot;
                   query_template =&gt; &quot;search-by-ip.json&quot;
                   fields =&gt; {
                           &quot;id&quot;  =&gt; &quot;[suscriberid]&quot;
                   }
                 }
           }
          
          
         output {
           stdout { codec =&gt; rubydebug }
         }
          
         -----------------
         search-by-ip.json
          
         {
           &quot;size&quot;: 1,
           &quot;query&quot;: { &quot;match&quot;:{&quot;IP&quot;: %{[ip]} } }
         }
         -------------------
         testcase.sh
          
         curl -XPOST &quot;localhost:8080&quot; -H &quot;Content-Type: application/json&quot; -d '{
           &quot;size&quot;: 1,
           &quot;query&quot;: { &quot;match&quot;:{&quot;ip&quot;: &quot;192.168.1.4&quot; }}
         }'
          
        ```  
  
  
  
  Thanks!
  </code></pre>