# Logstash is overwriting output elasticsearch
**URL:** https://discuss.elastic.co/t/logstash-is-overwriting-output-elasticsearch/246937
**Category:** Logstash
**Created:** [August 31, 2020, 10:44am UTC](https://discuss.elastic.co/t/logstash-is-overwriting-output-elasticsearch/246937 "2020-08-31T10:44:34Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Turotakun98](https://discuss.elastic.co/u/Turotakun98)
#### Post date: [August 31, 2020, 10:44am UTC](https://discuss.elastic.co/t/logstash-is-overwriting-output-elasticsearch/246937/1 "2020-08-31T10:44:35Z")
Hi,
Is it possible to add a field in elasticsearch output only if the document in the index does not contain that field?
I'm trying to fetch data from a API (using the input http\_poller) and storing the data in a elasticsearch index (using output elasticsearch). If the index does not contains a specific field i want to add it (with a default value). I need to check its existence because I have action 'update' and doc\_as\_upsert true.
Currently I'm using the "add\_field" in the http\_poller but at every schedule it overwrite the current value of the field stored in the index.
Current:
```auto
input {
http_poller {
urls => {
test1 => "http://localhost:9000/test"
}
request_timeout => 60
schedule => { cron => "* * * * *"}
codec => "json"
metadata_target => "http_poller_metadata"
add_field => { "status" => "active"}
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "test-2020.08.31"
document_id => "%{[uid]}"
action => 'update'
doc_as_upsert => true
}
}
```
When the value of "status" change after a schedule (eg. from "active" to "stopped") at the next schedule it will overwrite the current value (from "stopped" to "active")
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 28, 2020, 10:44am UTC](https://discuss.elastic.co/t/logstash-is-overwriting-output-elasticsearch/246937/2 "2020-09-28T10:44:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.