# Extract document id into another variable in logstash
**URL:** https://discuss.elastic.co/t/extract-document-id-into-another-variable-in-logstash/102643
**Category:** Logstash
**Created:** [October 4, 2017, 5:15am UTC](https://discuss.elastic.co/t/extract-document-id-into-another-variable-in-logstash/102643 "2017-10-04T05:15:20Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@raja\_gopal](https://discuss.elastic.co/u/raja_gopal)
#### Post date: [October 4, 2017, 5:15am UTC](https://discuss.elastic.co/t/extract-document-id-into-another-variable-in-logstash/102643/1 "2017-10-04T05:15:20Z")
I have a need to get document id for a particular condition. Get the document\_id from the document matching the query in elasticsearch input and assign it to a variable and later use that document id to delete a document through elasticsearch output plugin. How can i do this ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 4, 2017, 7:02am UTC](https://discuss.elastic.co/t/extract-document-id-into-another-variable-in-logstash/102643/2 "2017-10-04T07:02:04Z")
With the elasticsearch input's `docinfo` option you can get the document id and other metadata extracted to fields in the events it creates.
---
### Author:  [@raja\_gopal](https://discuss.elastic.co/u/raja_gopal)
#### Post date: [October 4, 2017, 7:16am UTC](https://discuss.elastic.co/t/extract-document-id-into-another-variable-in-logstash/102643/3 "2017-10-04T07:16:25Z")
My input is an xml document which i am going to send over tcp. I usually parse the xml and store it as event in elasticearch. Now for this condition also i have to parse the input through tcp with xml filter and then use one particular field to get the previous event. I used the elasticsearch filter plugin where i can use fields option to copy data from previous event to new event. Problem is when i use this condition the tcp is not working.
```
tcp {
port => 5043
type => "tcp"
}
xml {
store_xml => true
source => message
target => parsed_message
force_array => false
remove_field => "message"
}
if [parsed_message][NotificationType] == "CLEAR" {
elasticsearch {
hosts => ["x.x.x.x:9200","x.x.x.x:9200"]
user => someuser
password => xxxxxxx
index => "previousevent"
query => "parsed_message.Name: %{[parsed_message][Name]} AND last_notified_at: %{last_notified_at}"
fields => {"document_id" => ref_id }
}
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 4, 2017, 10:14am UTC](https://discuss.elastic.co/t/extract-document-id-into-another-variable-in-logstash/102643/4 "2017-10-04T10:14:21Z")
> Problem is when i use this condition the tcp is not working.
What do you mean?
---
### Author:  [@raja\_gopal](https://discuss.elastic.co/u/raja_gopal)
#### Post date: [October 5, 2017, 9:13am UTC](https://discuss.elastic.co/t/extract-document-id-into-another-variable-in-logstash/102643/5 "2017-10-05T09:13:09Z")
I got it working. The error was because the filter elasticsearch was not installed.
---
### Author:  [@raja\_gopal](https://discuss.elastic.co/u/raja_gopal)
#### Post date: [October 5, 2017, 10:50am UTC](https://discuss.elastic.co/t/extract-document-id-into-another-variable-in-logstash/102643/6 "2017-10-05T10:50:33Z")
Now the problem is the filter is querying elasticsearch but the "ref\_id" is always coming as nil. Could someone help ?
---
### Author:  [@raja\_gopal](https://discuss.elastic.co/u/raja_gopal)
#### Post date: [October 6, 2017, 5:56am UTC](https://discuss.elastic.co/t/extract-document-id-into-another-variable-in-logstash/102643/7 "2017-10-06T05:56:32Z")
My issue is the same as in [Logstash elasticsearch filter error TypeError: can't convert nil into String](https://discuss.elastic.co/t/logstash-elasticsearch-filter-error-typeerror-cant-convert-nil-into-string/75125)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 3, 2017, 5:56am UTC](https://discuss.elastic.co/t/extract-document-id-into-another-variable-in-logstash/102643/8 "2017-11-03T05:56:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.