# Import addresses into Elasticsearch using Logstash **URL:** \ **Category:** Logstash\ **Created:** [February 5, 2019, 10:43am UTC](https://discuss.elastic.co/t/import-addresses-into-elasticsearch-using-logstash/167098 "2019-02-05T10:43:23Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![DaniSusB](https://avatars.discourse-cdn.com/v4/letter/d/8e7dd6/32.png) [@DaniSusB](https://discuss.elastic.co/u/DaniSusB)\ **Post date:** [February 5, 2019, 10:43am UTC](https://discuss.elastic.co/t/import-addresses-into-elasticsearch-using-logstash/167098/1 "2019-02-05T10:43:23Z")
Hi, I'd like to import addresses into ES using Logstash. The thing is, I'd like to filter out the addresses that already exist in the ES index but I can't find a ES filter plugin that allows me to first check if the address already exists in ES. Any ideas? Or is Logstash the wrong approach? ---
**Author:** ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)\ **Post date:** [February 5, 2019, 10:53am UTC](https://discuss.elastic.co/t/import-addresses-into-elasticsearch-using-logstash/167098/2 "2019-02-05T10:53:29Z")
You could use the [fingerprint filter plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-fingerprint.html) to generate a fingerprint that you then use as the document id. Used together with the appropriate [action](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-action) in the elasticsearch output, you can then e.g. upsert (insert or update) the existing document, or just keep the first copy indexed. ---
**Author:** ![DaniSusB](https://avatars.discourse-cdn.com/v4/letter/d/8e7dd6/32.png) [@DaniSusB](https://discuss.elastic.co/u/DaniSusB)\ **Post date:** [February 5, 2019, 11:14am UTC](https://discuss.elastic.co/t/import-addresses-into-elasticsearch-using-logstash/167098/3 "2019-02-05T11:14:41Z")
Thanks for your answer. The problem is (and I forgot that to write, sorry) that the ES addresses are company data and the imported ones are customer data, therefore consistent hashes don't work. That's why I first thought a preceding query in a filter would solve my problem. ---
**Author:** ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)\ **Post date:** [February 5, 2019, 11:25am UTC](https://discuss.elastic.co/t/import-addresses-into-elasticsearch-using-logstash/167098/4 "2019-02-05T11:25:23Z")
I haven't tested this idea yet, but you could e.g. use the [elasticsearch filter plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elasticsearch.html) with a query template that matches your stored addresses, and then drop the new event if a match was found. ---
**Author:** ![DaniSusB](https://avatars.discourse-cdn.com/v4/letter/d/8e7dd6/32.png) [@DaniSusB](https://discuss.elastic.co/u/DaniSusB)\ **Post date:** [February 5, 2019, 12:41pm UTC](https://discuss.elastic.co/t/import-addresses-into-elasticsearch-using-logstash/167098/5 "2019-02-05T12:41:35Z")
Thanks for that input. I understand what you mean but I'm a newbie in the ELK stack and therefore have no clue how to implement this approach. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 5, 2019, 12:41pm UTC](https://discuss.elastic.co/t/import-addresses-into-elasticsearch-using-logstash/167098/6 "2019-03-05T12:41:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.