{"action":"created","issue":{"url":"https://api.github.com/repos/logstash-plugins/logstash-filter-elasticsearch/issues/20","repository_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-elasticsearch","labels_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-elasticsearch/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-elasticsearch/issues/20/comments","events_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-elasticsearch/issues/20/events","html_url":"https://github.com/logstash-plugins/logstash-filter-elasticsearch/issues/20","id":101313015,"number":20,"title":"Quotes on query fields are not working","user":{"login":"azimut","id":2867036,"avatar_url":"https://avatars.githubusercontent.com/u/2867036?v=3","gravatar_id":"","url":"https://api.github.com/users/azimut","html_url":"https://github.com/azimut","followers_url":"https://api.github.com/users/azimut/followers","following_url":"https://api.github.com/users/azimut/following{/other_user}","gists_url":"https://api.github.com/users/azimut/gists{/gist_id}","starred_url":"https://api.github.com/users/azimut/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/azimut/subscriptions","organizations_url":"https://api.github.com/users/azimut/orgs","repos_url":"https://api.github.com/users/azimut/repos","events_url":"https://api.github.com/users/azimut/events{/privacy}","received_events_url":"https://api.github.com/users/azimut/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2015-08-17T00:43:06Z","updated_at":"2016-06-30T11:43:33Z","closed_at":null,"body":"In the example provided the field \"operation\" is matched against the one \"opid\" on the new event. But, if opid is for example an url, and as such contains \":\" or \"/\", it would fail.\r\n\r\n```\r\n   elasticsearch {\r\n      hosts => [\"es-server\"]\r\n      query => \"type:start AND operation:%{[opid]}\"\r\n      fields => [\"@timestamp\", \"started\"]\r\n   }\r\n```\r\n\r\nThis could be fixed by quoting the whole \"opid\".\r\n```\r\n      query => \"type:start AND operation:\\\"%{[opid]}\\\"\"\r\n```\r\nBut this or other attempts to quote the search string are not working. \r\n```\r\nmessage=>\"Failed to query elasticsearch for previous event\", :query=>\"type:rss AND link:\\\\\\\"https://www.domain.com/path/\\\\\\\"\"\r\n```\r\n\r\nPlease advice."},"comment":{"url":"https://api.github.com/repos/logstash-plugins/logstash-filter-elasticsearch/issues/comments/229635163","html_url":"https://github.com/logstash-plugins/logstash-filter-elasticsearch/issues/20#issuecomment-229635163","issue_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-elasticsearch/issues/20","id":229635163,"user":{"login":"muaazsaleem","id":5851294,"avatar_url":"https://avatars.githubusercontent.com/u/5851294?v=3","gravatar_id":"","url":"https://api.github.com/users/muaazsaleem","html_url":"https://github.com/muaazsaleem","followers_url":"https://api.github.com/users/muaazsaleem/followers","following_url":"https://api.github.com/users/muaazsaleem/following{/other_user}","gists_url":"https://api.github.com/users/muaazsaleem/gists{/gist_id}","starred_url":"https://api.github.com/users/muaazsaleem/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/muaazsaleem/subscriptions","organizations_url":"https://api.github.com/users/muaazsaleem/orgs","repos_url":"https://api.github.com/users/muaazsaleem/repos","events_url":"https://api.github.com/users/muaazsaleem/events{/privacy}","received_events_url":"https://api.github.com/users/muaazsaleem/received_events","type":"User","site_admin":false},"created_at":"2016-06-30T11:43:33Z","updated_at":"2016-06-30T11:43:33Z","body":"@jordansissel I have been stuck on this for two days, finally your comment is what helped! "}}
{"actor":{"display_login":"muaazsaleem"}}