Document_id overwriting all the data

Hi, I have a JSON field named as "payload.user_id". Now in logstash output file I have mentioned index as well as document_id => "%{payload.user_id}". But instead of taking the value of user id as _id. It is showing _id as "%{payload.user_id}", which is in turn overwriting everything keeping just one document.

I think it should be ‘%{[payload][user_id]}’.

Thanks, it works.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.