Logstash conf output to elasticsearch with document_id set only indexes one record

Hi,

I am using logstash to populate data from SQL server to elastic.

When I specify document_id (as below) I only get one document in my index. If I do not specify that document_id field should be taken from PolicyId, I get all the records. Any ideas?

# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
  beats {
    port => 5044
  }
}

input {  
	jdbc {
		# SqlServer jdbc connection string to your database, productdb
		#  "jdbc:sqlserver://HostName\instanceName;database=DBName;user=UserName;password=Password" 
		jdbc_connection_string => "jdbc:sqlserver://10.130.40.20;database=ApiTeamExposureHub;user=exposure;password=test@123"
		# The user you want to execute your statement as
		jdbc_user => nil
		# The path to your downloaded jdbc driver
		# jdbc_driver_library => "C:/Program Files/sqljdbc_6.0/enu/jre8/sqljdbc42.jar"
		jdbc_driver_library => "C:\Program Files\Microsoft JDBC DRIVER 9.2 for SQL Server\sqljdbc_9.2.1.0_enu\sqljdbc_9.2\enu\mssql-jdbc-9.2.1.jre11.jar"
		# The name of the driver class for SqlServer
		jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
		# Query for testing purpose
		statement => "portfolio.usp_Policy_SelectListForElasticsearch"
	}
}

output {
  elasticsearch {
    hosts => ["https://UKEE-EXP004:9200"]
    index => "policylocalexposurehub"
    user => "elastic"
    password => "p7p8qHk9GdU0v0RLUDM9"
	ssl => true
    cacert => 'config\elasticsearch-ca.pem'
	document_id => "%{PolicyId}"
  }
}

https://UKEE-EXP004:9200/policylocalexposurehub/_count

{
    "count": 1,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    }
}

image

Mappings are all transformed into lower case so the document_id needs to be specified in lower case.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.