# Logstash Action

**URL:** <https://discuss.elastic.co/t/logstash-action/369054>\
**Category:** Logstash\
**Created:** [October 18, 2024, 12:15pm UTC](https://discuss.elastic.co/t/logstash-action/369054 "2024-10-18T12:15:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tam2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tam2/32/68143_2.png) [@Tam2](https://discuss.elastic.co/u/Tam2)\
**Post date:** [October 18, 2024, 12:15pm UTC](https://discuss.elastic.co/t/logstash-action/369054/1 "2024-10-18T12:15:37Z")

</div>

I'm currently upgrading logstash + elasticsearch from 7.x to 8.x but am getting this error within the logstash pipeline

```auto
[WARN][logstash.outputs.elasticsearch][main][790066835755a2e9e8ffb361aa7273a3b82493ee370893269ac96e8138475316] Elasticsearch doesn't support [%{[@metadata][action]}] action;

```

In my pipeline i have the following

```auto
filter {
if [auditActivity] == "I" or [auditActivity] == "U" {
    mutate { add_field => { "[@metadata][action]" => "index" } }
  } else if [auditActivity] == "D" {
    mutate { add_field => { "[@metadata][action]" => "delete" } }
  } 

mutate { 
  remove_field => ["auditId", "auditActivity"]
  }
}

output { 
  elasticsearch {
    action => "%{[@metadata][action]}"
    document_id => "%{[id]}"
  }
 
}

```

This works fine in our current production environment on 7.x, but on my test on 8.x it doesn't seem to like it

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 18, 2024, 12:57pm UTC](https://discuss.elastic.co/t/logstash-action/369054/2 "2024-10-18T12:57:46Z")

</div>

You need to share the rest of your pipeline and some sample message so people may try to replicate your issue.

The warning you get means that the field `%{[@metadata][action]}` wasn't populate with any value, your conditional that adds the value `index` or `delete` to it didn't work for this specific message.

You may have an error in your parse and your filter needs to be changed, but you need to provide your pipeline and some sample message.

---

<div class="post-metadata">

**Author:** ![Tam2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tam2/32/68143_2.png) [@Tam2](https://discuss.elastic.co/u/Tam2)\
**Post date:** [October 18, 2024, 1:43pm UTC](https://discuss.elastic.co/t/logstash-action/369054/3 "2024-10-18T13:43:36Z")

</div>

I found the issue was due to this

> <https://github.com/logstash-plugins/logstash-input-jdbc/issues/320>
>
> Hi,
> It seems that 'lowercase\_column\_names' parameters does not work in some con…figuration.
> My SQL statement converts all name in camel case and I can clearly see that in the filter stage, all names are lowered despite having configured 'lowercase\_column\_names =\> false'. Here is an excerpt of my config file:
> \>input{
> \>jdbc{
> \>jdbc\_driver\_library =\> "../sql\_driver/postgresql-42.2.4.jar"
> \> jdbc\_driver\_class =\> "org.postgresql.Driver"
> \>jdbc\_connection\_string =\> "jdbc:postgresql://..."
> \>statement =\> "select work\_order\_id as workOrderId from t\_wo where last\_update \> :sql\_last\_value"
> \>last\_run\_metadata\_path =\> "../config/last\_run"
> \>schedule =\> "/5 \* \* \* \* \* "
> \>lowercase\_column\_names =\> false
> \>}
> \>}
> 
> At filter stage \*workOrderId\* becomes \*workorderid\*

As we are also moving from SQL Server -\> Postgres it seems there are differences, updating the statement and it's working correctly now with escaping the quotes