Edit field "action"

Elastic Stack Logstash
1

Hi, i'm new on ES and i have a problem with csv ingestion.
I want to edit data on ES when a field has a specific value.

Like:
Id,Name,Operation
1,Jack,Edit
2,,Delete

I want something like this in my Logstash configuration:
`input {
stdin{}
}

filter {
  csv {
      separator => ","
      skip_header => "true"
      columns => ["id","clientName","operation"]  --> 
  }
  
}

output {
   if ("delete" == "%operation"){
    elasticsearch {
                    action => "delete" 
                    document_id => "%{id}"  
                    index => "index"
                    hosts  =>  ["127.0.0.1:9200"]
        }
} else {  #update
}    
        stdout { codec => rubydebug }
}`

it is possibile?
thanks for the answers

2

That should be

if [operation] == "delete" {
1 Like
3

it works well, thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.