我正在使用Logstash Elasticsearch过滤器获取主机名使用查询模板如下所述-

• sample.json*

{
  "size": 1,
   "query": {
    "query_string": {
      "query": "[local_metadata.host.id]:%{[host.id]}"
    }
  } }

然而，当我测试logstash管道时，它给出了下面提到的警告-

[WARN ] 2023-04-28 09:59:01.047 [[main]>worker1] elasticsearch - Failed to query elasticsearch for previous event {:index=>".fleet-agents", :error=>"[400] {\"error\":{\"root_cause\":[{\"type\":\"query_shard_exception\",\"reason\":\"Failed to parse query [[local_metadata.host.id]:%{[host.id]}]\",\"index_uuid\":\"3_qR6WxhRRugbHtormpQkg\",\"index\":\".fleet-agents-7\"}],\"type\":\"search_phase_execution_exception\",\"reason\":\"all shards failed\",\"phase\":\"query\",\"grouped\":true,\"failed_shards\":[{\"shard\":0,\"index\":\".fleet-agents-7\",\"node\":\"ECbgB995T6OYF-0I-sus6A\",\"reason\":{\"type\":\"query_shard_exception\",\"reason\":\"Failed to parse query [[local_metadata.host.id]:%{[host.id]}]\",\"index_uuid\":\"3_qR6WxhRRugbHtormpQkg\",\"index\":\".fleet-agents-7\",\"caused_by\":{\"type\":\"parse_exception\",\"reason\":\"Cannot parse '[local_metadata.host.id]:%{[host.id]}': Encountered \\\" \\\"]\\\" \\\"] \\\"\\\" at line 1, column 23.\\nWas expecting:\\n    \\\"TO\\\" ...\\n    \",\"caused_by\":{\"type\":\"parse_exception\",\"reason\":\"Encountered \\\" \\\"]\\\" \\\"] \\\"\\\" at line 1, column 23.\\nWas expecting:\\n    \\\"TO\\\" ...\\n    \"}}}}]},\"status\":400}"}

注意：在开发工具中查询工作正常

GET .fleet-agents/_search
{
 "query": {
   "match": {
     "local_metadata.host.id": "222222-222-2222-22-222"
   }
 } 
}

• logstash管道 *

input {
        elasticsearch
        {
        hosts => "localhost"
        user => "reader"
        password => "**************"
        index => "*-test"
        query => '{ "query": {
                             "bool": {
                                      "must": [{"terms": { "kibana.alert.severity": [ "high", "critical"] }} ],
                                      "filter": [ {"range": {"@timestamp": { "gte": "now-2w"}}}]
                                     }
                             }
                  }'
        schedule => "/1 * * * *"
        size => 500
        scroll => "5m"
        docinfo => true
        docinfo_target => "[@metadata][doc]"
        codec => "json"
        }
    }


filter {
elasticsearch {
              hosts => "localhost"
              user => "fleet-user"
              password => "************"
              index => ".fleet-agents"
              query_template => "/data/logstash/pipelines/sample.json"
              fields => { "host.name" => "host_name" }
              }

mutate {
        add_field => {
            "alertHostName" => "%{[host_name]}"
            "alertReason" => "%{kibana.alert.reason}"
            "alertSeverity" => "%{kibana.alert.severity}"
            "alertTime" => "%{kibana.alert.original_time}"

        }
    }

}

output {
stdout {
 codec => "json"
}
}

你能帮助我在查询模板中匹配查询的正确语法吗？
先谢谢你了！