Elasticsearch Delete action does not take effect

Elastic Stack Logstash
1

Hi,

I am using Logstash 2.4.0 and Elasticsearch 2.4.0

Below is my logstash conf,

filter {
    json {
        source => "message"
    }
    if ([root][ns0:selection][isFinished] == "true" or [root][ns0:market][isFinished] == "true") {
        mutate {
            add_field => { "perfom" => "delete" }
        }
    }
}

output {
    #stdout { codec => rubydebug }
    if ( [perform] == "delete") {
        elasticsearch {
            hosts => ["eshost:9201"]
            index => "test"
            document_id => "%{id}"
            action => "delete"
        }
    }
    else {
        elasticsearch {
            hosts => ["eshost:9201"]
            index => "test"
            document_id => "%{id}"
            doc_as_upsert => true
            action => "update"
        }
    }
}

On certain conditions I either try to upsert a document or delete the document.

I expect the first "if" block in the Output section to delete the document and the second "if" block to update. Updates are happening fine. And I can see that "perform" is getting set to "delete" but document is not getting deleted. Is there a reason for that? Am I doing something wrong?

Also, if there's a better way to achieve what I am trying to do please feel free to suggest.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.