lets say i have an index iptables-%{+YYYY.MM}, which holds iptables kernel generated logs. i would like to: 1- create the doc if the log line doesn't exists or 2- increment a field called counter if it already exists every doc would be saved for the first time with a counter, incrementing on ev…

the strange thing is that i actually do have a index template mapping "properties": { "@timestamp": { "type": "date" }, "counter": { "type": "long" }, and kibana mapped it as number, so it seems right anyway, got it to work with script => "if (ctx._source['counter'] == null) { ct…

Discuss the Elastic Stack

Increment counter if document already exists

Elastic Stack Logstash

yodog (Yodog) July 11, 2018, 2:34pm 5

also,

Topic		Replies	Views
Increment similar event count if occurs inside time window Elasticsearch	1	502	January 17, 2018
How do I increment my count field of my document from logstash? Elasticsearch	1	1615	July 5, 2017
Upsert / Update if exist, create if not Logstash	3	9938	September 7, 2019
Logstash create doc if not exist else append array Logstash	3	3644	November 30, 2018
Increment field value when event occur in logstash output Logstash	1	559	November 12, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Increment counter if document already exists

Related topics