Hello @stephenb , the problem was in the fingerprint as you said. I solved the problem. Actually there are over 1.5 billion documents in the index and the index has only one shard so I thought the problem was in the shards or in the memory. I didn't think it would overwrite. Thank you so much for reminding me of this. You helped me a lot to improve myself on Elasticsearch and logstash, thank you for everything and all help 
1 Like