# Document deleted after logstash execution **URL:** \ **Category:** Logstash\ **Created:** [April 30, 2021, 12:56pm UTC](https://discuss.elastic.co/t/document-deleted-after-logstash-execution/271774 "2021-04-30T12:56:07Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![sourabhjain104](https://avatars.discourse-cdn.com/v4/letter/s/bc79bd/32.png) [@sourabhjain104](https://discuss.elastic.co/u/sourabhjain104)\ **Post date:** [April 30, 2021, 12:56pm UTC](https://discuss.elastic.co/t/document-deleted-after-logstash-execution/271774/1 "2021-04-30T12:56:07Z")
Hello, I am using the latest version of ELK (7.11.2) on ubuntu 18.4. I am getting data from postgre using JDBC My logstash.conf file look lile : `input { jdbc { jdbc_connection_string =>"jdbc:postgresql://123.0.0.1:5432/elk" jdbc_user => "elk" jdbc_password => "asco" jdbc_driver_class => "org.postgresql.Driver" jdbc_driver_library => "/etc/logstash/postgresql-42.2.20.jar" statement => "SELECT * from elk.w7_log" jdbc_default_timezone => "Europe/Paris" schedule => "*/5 * * * * *" } } output { elasticsearch { hosts => ["http://localhost:9200"] index => "plwelk" #document_id => "users_%{userid}" document_id => "%{id}" #doc_as_upsert => true #action => "update" #user => "elk" } } ` In my index "plwelk" I can see maximum 2 documents. When I execute /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/elk.conf its deleting 3rd document. I dont want to delete any documents and dont know how to prevent. I the attached 2 screenshot you can see that I have document with Apr 29, 2021 and Apr 22, 2021 but after execution of logstash (/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/elk.conf) on Apr 30, 2021 I lost Apr 28, 2021 ![ELK1.PNG](https://us1.discourse-cdn.com/elastic/original/3X/d/d/dd9770275f5d99c6b0c715af12e6ef79f1d091a1.jpeg) ![ELK2](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e5927dd013fd94e3b66ed61c69c71a5a473f2deb.png) can you please tell me why? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 30, 2021, 3:10pm UTC](https://discuss.elastic.co/t/document-deleted-after-logstash-execution/271774/2 "2021-04-30T15:10:57Z")
> [@sourabhjain104](#): > > can you please tell me why? What is the \_id value on each document? You are setting the document\_id option on the elasticsearch output, so if there are two events with the same value of %{id} the second will overwrite the first. ---
**Author:** ![sourabhjain104](https://avatars.discourse-cdn.com/v4/letter/s/bc79bd/32.png) [@sourabhjain104](https://discuss.elastic.co/u/sourabhjain104)\ **Post date:** [April 30, 2021, 3:54pm UTC](https://discuss.elastic.co/t/document-deleted-after-logstash-execution/271774/3 "2021-04-30T15:54:09Z")
Hello Badger, Thanks for reply. I don't know what I can put to get unique id. In my database table (w7\_log) I dont have any column which is unique. Can you please suggest me how I can generate unique id.? Also is it mandatory to provide id? Can't I remove #document\_id =\> "users\_%{userid}" from the output of my conf file? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 30, 2021, 3:57pm UTC](https://discuss.elastic.co/t/document-deleted-after-logstash-execution/271774/4 "2021-04-30T15:57:41Z")
The document\_id option on the elasticsearch output is optional. If you do not supply it then a unique id will be generated. ---
**Author:** ![sourabhjain104](https://avatars.discourse-cdn.com/v4/letter/s/bc79bd/32.png) [@sourabhjain104](https://discuss.elastic.co/u/sourabhjain104)\ **Post date:** [April 30, 2021, 4:04pm UTC](https://discuss.elastic.co/t/document-deleted-after-logstash-execution/271774/5 "2021-04-30T16:04:54Z")
Ok, thanks Badger, I will remove and execute logstash again tomorrow. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 28, 2021, 4:05pm UTC](https://discuss.elastic.co/t/document-deleted-after-logstash-execution/271774/6 "2021-05-28T16:05:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.