Couchdb_changes index only doc field from event

Elastic Stack Logstash
15

@alexey, I took a (very) quick look into this last night. The below block from 'logstash-input-couchdb_changes' builds the event, assigns the document to the doc field and deletes the _id and _rev field from the document. This could be easily changed to achieve the desired result - you could add a flag to toggle on/off.

if line['doc']['_deleted']
          hash['@metadata']['action'] = 'delete'
        else
          hash['doc'] = line['doc']
          hash['@metadata']['action'] = 'update'
          hash['doc'].delete('_id')
          hash['doc_as_upsert'] = true
          hash['doc'].delete('_rev') unless @keep_revision   
end

Alternatively, building on your example above, you could alter the event to resemble the couch document with the addition of add_field => { "_id" => "%{[@metadata][_id]}"} to add the _id field back and use the keep_revision on the input plugin. I.e:

input { 
    couchdb_changes {
        ...
        keep_revision => true
    }
}
filter{
    ruby {
        code => "event['doc'].to_hash.each{|k,v| event[k] = v}"
        remove_field => ["doc"]
        remove_field => ["doc_as_upsert"]
        remove_field => ["@version"]
        remove_field => ["@timestamp"]
        add_field => { "_id" => "%{[@metadata][_id]}"}
    }
}