How to prevent duplicate events which is already pushed into elastic using watcher action?

Hi there,

According to this Discuss thread, if id, type, and destination index of the documents are the same, then Elasticsearch will automatically avoid duplicating the documents for you.

However if that's problematic, I think you can configure your Watcher with a webhook action to send the document to Logstash instance. You can configure Logstash to use a concept called "fingerprinting" to de-duplicate documents. Take a look at the section called "De-duplicating similar content" in this "Handling Duplicates" blog post.

Thanks,
CJ