The _id does not exist in your logstash document, it will be created by elasticsearch when it receives the document.
To do what you want you would need to set the document id in logstash using the document_id option, but how to do that will depend on your document, if you have any field or combination of fields that it is unique.
I was trying to to give name of _id for call him in variable like
document_id = refid http://xxx/5601/app/discover#/doc/82de0080-acd9-11eb-a4b8-614232a13000/indexname?id=%refid
thank's it's finally work with your sentence
body => "something happened: %{message} http://xxx/5601/app/discover#/doc/82de0080-acd9-11eb-a4b8-614232a13000/indexname?id=%{[@metadata][fingerprint]}"
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.