Inputting Mongodb events in Elasticsearch _id is a metadatafield and cannot be added


(Lisa Deng) #1

We're outputting mongodb records into filebeat, and then sending those filebeat logs to Elasticsearch, where it will be converted to Json.

However, Mongo has an _id field already, so we get a failed action error from Logstash.
I'm trying to delete the _id field from Mongo.
I thought that I could try to remove the _id field in the filter plugin before it got to output, but I still get the failed action error.

Any tips on how to mitigate this problem?


(Lisa Deng) #2

I figured that one workaround
would be that instead of specifying the codec => json on the input plugin,
that I instead use the json filter, and do target => doc, which nests the fields.
I would've preferred them on the top level, but this works fine as well.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.