I have imported a data of 3.5 crore documents in elasticsearch by using logstash. After I found that the unique field "_id" is not generated. Now, I want to generate the unique field as "_id" on all the documents. Can anyone help me ?
If your events have a field that you want to use as the _id in Elasticsearch, you'll have to configure the document_id in your output as "%{your_field_with_a_unique_value_per_document}". If you do not already have a field that you can use as an ID, you can either use the ID that ES generates automatically or build a fingerprint based on some fields of your document.
1 Like
Thanks @Jenni for your reply but the issue is that ES hasn't generated any ID for the documents i have imported through logstash. I didn't have any unique field in the data. So, I need to create an unique field. What should I do in this case ?
It's impossible to have documents without an _id in Elasticsearch. Why do you think there is none?
1 Like
Because when I checked the mappings, it is not showing me any field like _id or simply ID. The extra fields that ES created are version, timestamp, path and host.
The _id is a meta-field and won't show up in the field mappings. But if you look at your data in Kibana Discover, you'll see that each document has an _id.
I got it. But when I sent a request like
GET _sql{
"query" : " select _id from index "
}
then the response is like
Unknown column [_id].
This scenario is only for the indexes I imported through logstash.
This is a constraint of SQL:
Ok. Thanks for making it clear to me.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.