I'd like to know if there is a way to drop/overwrite previous csv documents if a field value already exists.
In my screenshot above globalCallID is what I want to match on.
Take globalCallID_callID number 263504...
That document would only exist in Elasticsearch as:
Would it be possible to do something similar to this? Logstash - how to overwrite document instead of creating new ones
output { elasticsearch { host => 'your es host' action => 'update' document_id => "%{[globalCallID_callId]}" index => 'your index name } }
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.