How to call mget from Logstash?

The REST request below works in Kibana.

Can this similarly be achieved in Logstash? I am trying to retrieve multiple documents from multiple indices(5 indices) in a single request to ElasticSearch in Logstash.

GET /_mget
      "docs": [
          "_index": "index1",
          "_id": "A"
          "_index": "index2",
          "_id": "B"


I do not think the elasticsearch input can be configured to use an _mget call. It might be possible with an http_poller input. Obviously you lose access to all the options of the elasticsearch input if you do that.

Oh, let me clarify. I was intending for it to be a filter instead. The objective is to join 5 indices to the current event. I could use ElasticSearch as a filter but I can only query one index at a time. 5 indices would mean 5 queries. Is there a way to do this in a single query so essentially one network hop?

    input {
      #reading from a CSV file

    filter {
    #retrieve documents from index1 and index2 and join with current event

    output {
      elasticsearch {
        hosts => ES
        index => "index3"
       action => "update"
        document_id => "%{key)"
        doc_as_upsert => true


Both the input and filter call, and I do not think that method can be told to _mget. You have the option of using an http filter to make the call to elasticsearch.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.