Avoid duplication

[wwalker (Walker)]

@Christian_Dahlqvist

@wwalker

Q1: You mention that having Elasticsearch handle identifier assignment is the most efficient but then you give a process where logstash generates an identifier. Is this the only way to prevent duplication and have an event updated on ingest? Is it possible to use the pre-existing _id field?

What pre-existing _id field? As soon as you supply an ID, it has to be treated as a potential update, which is slower.

I have a few different indexes and they all display a field of some type called _id. Am I misunderstanding what this is?