Copy Field from a new processed document to an old Document

Hi all,
I am trying to copy field from a new document received in logstash to an old one exists in the elasticsearch server.

For example:
There are 2 events, lets call them event1 and event2

event1{name: "xyz",lastname:"abc"} - recieved in 12:00am
event2{name: "dfs",lastname:"asdf",status:3} - recieved in 12:30am

I want to copy the status field from event2 to event2(event 1 already indexed)

I tried many options with elasticsearch output plugin but could only merge the documents.
How can I copy only the status field?

The purpose of this is because i'm creating a transform from those events and the transform must be grouped by the "status" field.

Thanks alot for helping!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.