Logstash elasticsearch output configuration:partial update with doc

[Maher.Glenza]

hi ,
plz how can i use the partial update with "doc" in logstash for elasticsearch output?
thanks

[JKhondhu (Jymit Singh Khondhu)]

Are you looking for something along the lines of: https://www.elastic.co/guide/en/elasticsearch/guide/master/partial-updates.html#partial-updates

[Maher.Glenza]

yes but it didn t work when i put the doc config in my logstash.json config file

[JKhondhu (Jymit Singh Khondhu)]

Can you share your logstash output?

[Maher.Glenza]

this is my logstash.json

input {

file {
path =>"C:\elk\pvin"
type => "logs"
start_position => beginning
sincedb_path => "C:\elkstack\ELK\logstash-5.1.2-Pvin\data\plugins\inputs\file.sincedb_5eed3ff4207ce42c69ff2b34b669aa79"

}
}

filter {
mutate {
gsub => ["message","|"," "]
}

grok {
match => ["message","%{TIMESTAMP_ISO8601:datePvin} : %{UUID:idFlux} %{NUMBER:daterecepPvin} %{NUMBER:datefintraitPvin} %{NUMBER:delai} %{WORD:nomFlux} %{GREEDYDATA:evts} %{WORD:BU} %{NUMBER:reforigin} %{NOTSPACE:contractoidval} %{DATA:useroidval} %{DATA:errorStatus} %{GREEDYDATA:errorDesc} %{NOTSPACE:servname}"]
}

}

output {
elasticsearch {
hosts => "localhost:9200"
index => "router-%{+YYYY.MM.dd}"
action => "update"
document_id => "%{[idFlux]}"
doc => {
"daterecepPvin" => "%{daterecepPvin}"
}
}
}