I want to update an Index based on session id present in the data
i'm reading
so in the current data i would be reading transaction number, createdate and also session id, if this session id matches with the session id of 'apply-to-cms' index then i want to update reference number and submit time of index apply-to-cms with the fields transaction number and createdDate. Is the below syntax correct ? never used script before.
elasticsearch
{
hosts => ["${ES_NODE}"]
resurrect_delay => 300
index => "logstash-apply-to-cms*"
user => "${ES_USER_NAME}"
password => "${ES_USER_PASSWORD}"
action => "update"
ssl_enabled => true
ssl_verification_mode => "${SSL_VERIF_MODE}"
ssl_certificate_authorities => "/etc/logstash/ssl/sdx-ca.pem"
ssl_key => "/etc/logstash/ssl/sdx.key"
ssl_certificate => "/etc/logstash/ssl/sdx.cer"
script => "if (params.event.get('session_id.keyword') == params.apply_session_id) {ctx._source['reference_number'] = params.transactionNumber;ctx._source['submitted_ts'] = params.createdDate;}" params => { apply_session_id => "%{apply_session_id}" transactionNumber => "%{[cps_completed][business_interest][transactionNumber]}" createdDate => "%{[cps_completed][business_interest][createdDate]}"}
}
i got below error in logstash
Failed to execute action {:id=>:"tns-cps-monitoring", :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Unableto configure plugins: (ConfigurationError) Something is wrong with your configuration.", :backtrace=>["org.logstash.config.ir.CompiledPipeline.<init>(CompiledPipeline.java:120)", "org.logstash.execution.AbstractPipelineExt.initialize(AbstractPipelineExt.java:186)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.reload.RUBY$method$execute$0(/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/reload.rb:51)", "usr.share.logstash.logstash_minus_core.lib.logstash.agent.RUBY$block$converge_state$2(/usr/share/logstash/logstash-core/lib/logstash/agent.rb:386)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:141)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:64)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", "org.jruby.runtime.Block.call(Block.java:143)", "org.jruby.RubyProc.call(RubyProc.java:309)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:107)", "java.base/java.lang.Thread.run(Thread.java:833)"]}
Modifications: getting the doc_id/fingerprint from the index and using fingerprint to update the index - No errors Now
elasticsearch
{
hosts => ["${ES_NODE}"]
resurrect_delay => 300
index => "logstash-apply-to-cms*"
user => "${ES_USER_NAME}"
password => "${ES_USER_PASSWORD}"
action => "update"
document_id => "%{fingerprint}"
doc_as_upsert => true
ssl_enabled => true
ssl_verification_mode => "${SSL_VERIF_MODE}"
ssl_certificate_authorities => "/etc/logstash/ssl/sdx-ca.pem"
ssl_key => "/etc/logstash/ssl/sdx.key"
ssl_certificate => "/etc/logstash/ssl/sdx.cer"
script => "{ctx._source.success_payment.reference_number=params.event.get('[cps_completed][business_interest][transactionNumber]'); ctx._source.success_payment.submitted_ts=params.event.get('[cps_completed][business_interest][createdDate]')}"
}
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.