# How to create custom document \_id in logstash?

**URL:** <https://discuss.elastic.co/t/how-to-create-custom-document-id-in-logstash/116629>\
**Category:** Logstash\
**Created:** [January 23, 2018, 9:38am UTC](https://discuss.elastic.co/t/how-to-create-custom-document-id-in-logstash/116629 "2018-01-23T09:38:58Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![kasliwalroshni](https://avatars.discourse-cdn.com/v4/letter/k/5daacb/32.png) [@kasliwalroshni](https://discuss.elastic.co/u/kasliwalroshni)\
**Post date:** [January 23, 2018, 9:38am UTC](https://discuss.elastic.co/t/how-to-create-custom-document-id-in-logstash/116629/1 "2018-01-23T09:38:59Z")

</div>

This is sample logstash output filter.

```
output
{
   elasticsearch
   {
        hosts => ["localhost"]
        sniffing => true
        manage_template => false
        index => "mqtt-index-%{+YYYY.MM.dd}"
        document_id => "%{parsedMessage.device_id}"
        document_type => "iot_data"
   }
}

```

This code changes existing \_id as %{parsedMessage.device\_id} as it is. How to change \_id by another field?

---

<div class="post-metadata">

**Author:** ![devil\_srj7](https://avatars.discourse-cdn.com/v4/letter/d/8edcca/32.png) [@devil\_srj7](https://discuss.elastic.co/u/devil_srj7)\
**Post date:** [January 23, 2018, 9:59am UTC](https://discuss.elastic.co/t/how-to-create-custom-document-id-in-logstash/116629/2 "2018-01-23T09:59:46Z")

</div>

you can replace `"parsedMessage.device_id"` **in** `document_id => "%{parsedMessage.device_id}"`  
by any other field you like.

---

<div class="post-metadata">

**Author:** ![kasliwalroshni](https://avatars.discourse-cdn.com/v4/letter/k/5daacb/32.png) [@kasliwalroshni](https://discuss.elastic.co/u/kasliwalroshni)\
**Post date:** [January 23, 2018, 10:07am UTC](https://discuss.elastic.co/t/how-to-create-custom-document-id-in-logstash/116629/3 "2018-01-23T10:07:51Z")

</div>

thank you devil\_srj7......i got it, but the point is that it takes this string as it is as \_id like,

\_id = %{parsedMessage.device\_id}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 23, 2018, 10:08am UTC](https://discuss.elastic.co/t/how-to-create-custom-document-id-in-logstash/116629/4 "2018-01-23T10:08:42Z")

</div>

See [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references) for the syntax of nested fields.

---

<div class="post-metadata">

**Author:** ![kasliwalroshni](https://avatars.discourse-cdn.com/v4/letter/k/5daacb/32.png) [@kasliwalroshni](https://discuss.elastic.co/u/kasliwalroshni)\
**Post date:** [January 23, 2018, 10:22am UTC](https://discuss.elastic.co/t/how-to-create-custom-document-id-in-logstash/116629/5 "2018-01-23T10:22:37Z")

</div>

Thank you magnusbaeck. But, this is not nested field. The field name itself is parsedMessage.device\_id

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 23, 2018, 11:31am UTC](https://discuss.elastic.co/t/how-to-create-custom-document-id-in-logstash/116629/6 "2018-01-23T11:31:21Z")

</div>

Replace the elasticsearch output with a `stdout { codec => rubydebug }` output and show an example event produced by Logstash.

---

<div class="post-metadata">

**Author:** ![kasliwalroshni](https://avatars.discourse-cdn.com/v4/letter/k/5daacb/32.png) [@kasliwalroshni](https://discuss.elastic.co/u/kasliwalroshni)\
**Post date:** [January 23, 2018, 12:23pm UTC](https://discuss.elastic.co/t/how-to-create-custom-document-id-in-logstash/116629/7 "2018-01-23T12:23:48Z")

</div>

issue solved

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 20, 2018, 12:23pm UTC](https://discuss.elastic.co/t/how-to-create-custom-document-id-in-logstash/116629/8 "2018-02-20T12:23:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.