Groovy to Painless, get logstash event

Elastic Stack Elasticsearch
1

Hello,

I'm getting data from logstash, using update by script (indexed or file).
I need to update a field, only if the value already indexed is less than the one in the logstash event.

With groovy, it works well by using something like:

if ( ctx._source.FIELD < event.FIELD ) { ctx._source.FIELD = event.FIELD }

But I can't find if there's a way to do this with painless. I tried many things like params.FIELD, but I'm unable to get any data.

Here's my output:

elasticsearch {

hosts => ["127.0.0.1:9200"]
index => "log-%{+YYYY.MM}"
document_type => "logdata"
action => "update"
doc_as_upsert => "true"
script_type => "file"
script_lang => "painless"
script_var_name => "params"
script => "updatescript"
flush_size => "1500"
document_id => "%{[@metadata][generated_id]}"
manage_template => false
}

Does anyone have an advice ? Is it still possible to get logstash params from a script ?

Thank you

2

Ok I found it !

Instead "event.FIELD", I'm able to get params from logstash using "params.event.get("FIELD")"

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.