Enrich Processor, Lookups: how to Update once through Enrich Pipeline generated document

Elastic Stack Elasticsearch
1
  1. We have many Lookup-indexes and one enrich pipeline to decode some values.
  2. Data will be imported from a DB using logstash and a pipeline parameter within elasticsearch plugin.

output {
elasticsearch {
index => "customers"
pipeline => "countries_lookup"
... }
}

The question is: how can I update and reindex document using the same enrich pipeline? For example: I have a country ISO code within my document:
{
"countrycode":"US"
}
The pipeline adds a decoded nested object with a value for the country code:
{
"countrycode":"CH",
"countryname" : {
"code" : "CH",
"name" : "Schweiz"
}
}
Assume I want to update the document, change the country code, get new values from a lookup and reindex the document. How can I do that? is it possible to do it using logstash with input/http and output/elasticsearch plugins giving the same pipeline as a parameter? The "_update" feature from elasticsearch unfortunately has no "pipeline" parameter to make it easier.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.