Hi, I have a JSON field named as "payload.user_id". Now in logstash output file I have mentioned index as well as document_id => "%{payload.user_id}". But instead of taking the value of user id as _id. It is showing _id as "%{payload.user_id}", which is in turn overwriting everything keeping just one document.
I think it should be ‘%{[payload][user_id]}’.
Thanks, it works.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.