How to call mget from Logstash?

Elastic Stack Logstash
1

The REST request below works in Kibana.

Can this similarly be achieved in Logstash? I am trying to retrieve multiple documents from multiple indices(5 indices) in a single request to ElasticSearch in Logstash.

GET /_mget
    {
      "docs": [
        {
          "_index": "index1",
          "_id": "A"
        },
        {
          "_index": "index2",
          "_id": "B"
        }
      ]
    }

Thanks

2

I do not think the elasticsearch input can be configured to use an _mget call. It might be possible with an http_poller input. Obviously you lose access to all the options of the elasticsearch input if you do that.

3

Oh, let me clarify. I was intending for it to be a filter instead. The objective is to join 5 indices to the current event. I could use ElasticSearch as a filter but I can only query one index at a time. 5 indices would mean 5 queries. Is there a way to do this in a single query so essentially one network hop?

    input {
      #reading from a CSV file
    }

    filter {
    #retrieve documents from index1 and index2 and join with current event
    }

    output {
      elasticsearch {
        hosts => ES
        index => "index3"
       action => "update"
        document_id => "%{key)"
        doc_as_upsert => true
      }

    }
4

Both the input and filter call Elasticsearch::Client.search, and I do not think that method can be told to _mget. You have the option of using an http filter to make the call to elasticsearch.