So I have data that is getting exported to a JSON file, that's being uploaded to Elastic using FIlebeat.
One of the fields can change, and when that happens, I would like the record being updated in Elastic instead of uploading a new entry, which is the case now.
In this topic I found some information on this, it's called deduplication, and logically you can achieve that by giving the two records the same ID.
AlertId is a unique ID that's within the data, so I would like to use that as the document ID.
But this does not seem to work. Elastic still generates it's own ID. Can anyone explain what I have to do, to get this working?
I spook a little too soon. The document id is now correct. But what I expected to happen, does not happen. When one field changes, this does not get changed in Elastic now, but there is also no new entry. It looks like filebeat/elastic is ignoring it now somehow.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.