Get _id document on query

Elastic Stack Logstash
#1

Hello!
I need to get id in previous document.

My query:
query.json

{
"size" : 1,
"sort" : [ {"timestamp": "desc"} ],
"query": {
"query_string": {
"query": "AS:%{[name]}"
}
},
"_id": "%{[@metadata][_id]}"
}

But i can't get id. What wrong?

Maybe there is another way get _id in previous doc in logstash?

#2

If you are using an Elasticsearch input you can use the docinfo option to have the input add the document id to each event.

#4

No, i'm not use input elasticsearch.

#5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.