# Logstash elasticsearch output configuration:partial update with doc

**URL:** <https://discuss.elastic.co/t/logstash-elasticsearch-output-configuration-partial-update-with-doc/72863>\
**Category:** Elasticsearch\
**Created:** [January 26, 2017, 8:26am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-configuration-partial-update-with-doc/72863 "2017-01-26T08:26:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Maher.Glenza](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\
**Post date:** [January 26, 2017, 8:26am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-configuration-partial-update-with-doc/72863/1 "2017-01-26T08:26:01Z")

</div>

hi ,  
plz how can i use the partial update with "doc" in logstash for elasticsearch output?  
thanks

---

<div class="post-metadata">

**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\
**Post date:** [January 26, 2017, 1:02pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-configuration-partial-update-with-doc/72863/2 "2017-01-26T13:02:21Z")

</div>

Are you looking for something along the lines of: [https://www.elastic.co/guide/en/elasticsearch/guide/master/partial-updates.html#partial-updates](https://www.elastic.co/guide/en/elasticsearch/guide/master/partial-updates.html#partial-updates)

---

<div class="post-metadata">

**Author:** ![Maher.Glenza](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\
**Post date:** [January 26, 2017, 1:04pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-configuration-partial-update-with-doc/72863/3 "2017-01-26T13:04:34Z")

</div>

yes but it didn t work when i put the doc config in my logstash.json config file

---

<div class="post-metadata">

**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\
**Post date:** [January 26, 2017, 1:14pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-configuration-partial-update-with-doc/72863/4 "2017-01-26T13:14:28Z")

</div>

Can you share your logstash output?

---

<div class="post-metadata">

**Author:** ![Maher.Glenza](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\
**Post date:** [January 26, 2017, 1:24pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-configuration-partial-update-with-doc/72863/5 "2017-01-26T13:24:31Z")

</div>

this is my logstash.json

input {

file {  
path =\>"C:\elk\pvin"  
type =\> "logs"  
start\_position =\> beginning  
sincedb\_path =\> "C:\elkstack\ELK\logstash-5.1.2-Pvin\data\plugins\inputs\file.sincedb\_5eed3ff4207ce42c69ff2b34b669aa79"

}  
}

filter {  
mutate {  
gsub =\> ["message","|"," "]  
}

grok {   
match =\> ["message","%{TIMESTAMP\_ISO8601:datePvin} : %{UUID:idFlux} %{NUMBER:daterecepPvin} %{NUMBER:datefintraitPvin} %{NUMBER:delai} %{WORD:nomFlux} %{GREEDYDATA:evts} %{WORD:BU} %{NUMBER:reforigin} %{NOTSPACE:contractoidval} %{DATA:useroidval} %{DATA:errorStatus} %{GREEDYDATA:errorDesc} %{NOTSPACE:servname}"]   
}

}

output {  
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "router-%{+YYYY.MM.dd}"  
action =\> "update"  
document\_id =\> "%{[idFlux]}"  
doc =\> {  
"daterecepPvin" =\> "%{daterecepPvin}"  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 23, 2017, 1:24pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-configuration-partial-update-with-doc/72863/6 "2017-02-23T13:24:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.