Logstash elasticsearch input with _source disabled

Elastic Stack Logstash
1

Hi,

I'm using logstash elastic search input plugin to export elastic search indexes into csv file. Please note that _source is disabled for indices. The issue here is export works only when _source is enabled otherwise it doesn't work.

So how to export indices when _source field is disabled, I tried using _source as false to the query and tried adding stored_fields but it doesn't work.

Could you please help me in this case?

Here is my logstash config file,

input{
elasticsearch{
hosts => "localhost:9200"
index => "indexname"
query => '{"query": {"match_all": {}}}'
}
}
output{
csv{
fields => ["field1","field2"]
path => "/usr/share/logstash/tmp/csv-export1.csv"
}
stdout{codec => json}
}

Thanks,
Ravi

2

You can not export if source is disabled. That is one of the drawbacks of disabling the source field.

3

Thanks for your answer, but I'm able to see results using curl command by specifying stored_fields. Is to possible to mention stored_fields in elasticsearch input plugin or with _source=false?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.