# Extract json field and overwrite document

**URL:** <https://discuss.elastic.co/t/extract-json-field-and-overwrite-document/128738>\
**Category:** Logstash\
**Created:** [April 19, 2018, 3:41pm UTC](https://discuss.elastic.co/t/extract-json-field-and-overwrite-document/128738 "2018-04-19T15:41:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sneijky](https://avatars.discourse-cdn.com/v4/letter/s/dbc845/32.png) [@Sneijky](https://discuss.elastic.co/u/Sneijky)\
**Post date:** [April 19, 2018, 3:41pm UTC](https://discuss.elastic.co/t/extract-json-field-and-overwrite-document/128738/1 "2018-04-19T15:41:05Z")

</div>

Hello,  
I have the following json:

```
[
{
    "key": "Key-1",
    "field1": "hello",
    "field2": "world"
},
{
   
    "key": "Key-2",
    "field1": "hello",
    "field2": "world"
}
]

```

and the following logstash file:

```
input {
  http_poller {
    # List of urls to hit
    # URLs can either have a simple format for a get request
    # Or use more complex HTTP features
    urls => {
      myurl => {
        method => "GET"
        url => "http://localhost:8080/helloworld"
      }
    }
    # Decode the results as JSON
    codec => "json"
    # Schedule task
    schedule => { cron => "* * * * * UTC" }
  }

}

output {
  #debugging output
  
  stdout {
    codec => rubydebug
  }

  # elasticsearch output
    
  elasticsearch{
   hosts => "localhost"
   index => "helloworld"
  }
  
}

```

The problem is that this logstash creates multiple documents with the same key and I want logstash to replace existing document in the index. Anyway i can do that?  
Thanks in advance.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 19, 2018, 5:34pm UTC](https://discuss.elastic.co/t/extract-json-field-and-overwrite-document/128738/2 "2018-04-19T17:34:26Z")

</div>

Use the elasticsearch output's `document_id` option, perhaps like this:

```
document_id => "%{key}"
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 19, 2018, 3:40pm UTC](https://discuss.elastic.co/t/extract-json-field-and-overwrite-document/128738/4 "2018-05-19T15:40:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.