Extract json field and overwrite document

Elastic Stack Logstash
1

Hello,
I have the following json:

[
{
    "key": "Key-1",
    "field1": "hello",
    "field2": "world"
},
{
   
    "key": "Key-2",
    "field1": "hello",
    "field2": "world"
}
]

and the following logstash file:

input {
  http_poller {
    # List of urls to hit
    # URLs can either have a simple format for a get request
    # Or use more complex HTTP features
    urls => {
      myurl => {
        method => "GET"
        url => "http://localhost:8080/helloworld"
      }
    }
    # Decode the results as JSON
    codec => "json"
    # Schedule task
    schedule => { cron => "* * * * * UTC" }
  }

}

output {
  #debugging output
  
  stdout {
    codec => rubydebug
  }

  # elasticsearch output
    
  elasticsearch{
   hosts => "localhost"
   index => "helloworld"
  }
  
}

The problem is that this logstash creates multiple documents with the same key and I want logstash to replace existing document in the index. Anyway i can do that?
Thanks in advance.

2

Use the elasticsearch output's document_id option, perhaps like this:

document_id => "%{key}"
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.