How to loop or iterate in Logstash output plugin

Elastic Stack Logstash
1

So, if I have prepared a list or array of string data in LogStash filter using ElasticSearch plugin. I can save that array or list directly in another elasticsearch index from logstash output plugin.

But that list actually contains document_id of another related index which I would like to update. So basically I need a handle on that list or array to iterate and call elasticsearch from logstash output to update each and every document_id from that list.

Can you suggest me how to do this? I am unable to find a way around this.

e.g.,

'book' index has an array of 'person_id' and 'person_name'
'person' index also has an array of 'book_id' and 'book_name'

Now, if a book or person gets updated, I need to update the other index also, which will be an array.

2

Use a split filter to split the array with document ids into multiple events, then use an elasticsearch filter to obtain the current contents of the document and use it to put together the new document which you'll send to an elasticsearch output. Depending on what kind of update you want to perform maybe you can do a scripted update.

3

Thank you @magnusbaeck for your suggestion. I already resolved it using ruby filter and event cloning.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.