Copy Field from a new processed document to an old Document

Elastic Stack Logstash
1

Hi all,
I am trying to copy field from a new document received in logstash to an old one exists in the elasticsearch server.

For example:
There are 2 events, lets call them event1 and event2

event1{name: "xyz",lastname:"abc"} - recieved in 12:00am
event2{name: "dfs",lastname:"asdf",status:3} - recieved in 12:30am

I want to copy the status field from event2 to event2(event 1 already indexed)

I tried many options with elasticsearch output plugin but could only merge the documents.
How can I copy only the status field?

The purpose of this is because i'm creating a transform from those events and the transform must be grouped by the "status" field.

Thanks alot for helping!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.