# Elasticseach input plugin - docinfo field is not respected?

**URL:** https://discuss.elastic.co/t/elasticseach-input-plugin-docinfo-field-is-not-respected/95757
**Category:** Logstash
**Created:** [August 3, 2017, 6:15pm UTC](https://discuss.elastic.co/t/elasticseach-input-plugin-docinfo-field-is-not-respected/95757 "2017-08-03T18:15:53Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![wmathews](https://avatars.discourse-cdn.com/v4/letter/w/76d3ee/32.png) [@wmathews](https://discuss.elastic.co/u/wmathews)
#### Post date: [August 3, 2017, 6:15pm UTC](https://discuss.elastic.co/t/elasticseach-input-plugin-docinfo-field-is-not-respected/95757/1 "2017-08-03T18:15:54Z")

</div>

I'm trying to do some work with the elastic input plugin, and part of it is that I want to access the index for use in the eventual output. In the documentation there is the docinfo field, but (unless I don't understand how this is supposed to work) I can't get it to actually populate the [@metadata] fields.

```
input {
  elasticsearch {
   docinfo => true
   hosts => "http://localhost:9200"
   query => removed
   add_field => {
      'logstashCreatedIndex' => "%{['@metadata']['_index']}"
    }
  }
}

```

To my understanding of this plugin based on the documentation this should allow me to have the index saved in that field but what is happening is that the metadata index field isn't being recognized as a field. I've tried with and without the internal quotes and I've tried moving the 'add field' to one of the filters later in the document. I've tried specifically asking for the index field and the metadata location, as well as accessing the field with the event api in the ruby filter and accessing it directly in my output filter.

Is this something simple I just don't understand about the plugin or about the docinfo field?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 3, 2017, 6:46pm UTC](https://discuss.elastic.co/t/elasticseach-input-plugin-docinfo-field-is-not-respected/95757/2 "2017-08-03T18:46:56Z")

</div>

This is a bug in the plugin:

> <https://github.com/logstash-plugins/logstash-input-elasticsearch/issues/76>

If you add the field in a subsequent mutate filter it works:

```nohighlight
input {
  elasticsearch {
    hosts => "hallonet:9200"
    index => "logstash*"
    docinfo => true
  }
}
filter {
  mutate {
    add_field => {
      'logstashCreatedIndex' => "%{[@metadata][_index]}"
    }
  }
}

```

---

<div class="post-metadata">

### Author: ![wmathews](https://avatars.discourse-cdn.com/v4/letter/w/76d3ee/32.png) [@wmathews](https://discuss.elastic.co/u/wmathews)
#### Post date: [August 3, 2017, 11:13pm UTC](https://discuss.elastic.co/t/elasticseach-input-plugin-docinfo-field-is-not-respected/95757/3 "2017-08-03T23:13:55Z")

</div>

That worked, thanks.

Is there some property of the mutate filter that allows it access to the metadata fields that other plugins don't have? For instance, if I try to put [@metadata][\_index] as is in a csv output plugin it doesn't work, but the example in the documentation uses the elasticsearch output to access the field so I'm not sure where it can and can't be seen and it seems inconsistent.

Thanks for your help.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 31, 2017, 11:14pm UTC](https://discuss.elastic.co/t/elasticseach-input-plugin-docinfo-field-is-not-respected/95757/4 "2017-08-31T23:14:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
