# Logstash - not update a document even if document\_id is specified

**URL:** <https://discuss.elastic.co/t/logstash-not-update-a-document-even-if-document-id-is-specified/283660>\
**Category:** Logstash\
**Created:** [September 8, 2021, 1:09pm UTC](https://discuss.elastic.co/t/logstash-not-update-a-document-even-if-document-id-is-specified/283660 "2021-09-08T13:09:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![reed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reed/32/122863_2.png) [@reed](https://discuss.elastic.co/u/reed)\
**Post date:** [September 8, 2021, 1:09pm UTC](https://discuss.elastic.co/t/logstash-not-update-a-document-even-if-document-id-is-specified/283660/1 "2021-09-08T13:09:47Z")

</div>

Hi all,

I'm new with elastic technology and I wold ask this:

I have my pipeline with

output  
{  
elasticsearch  
{  
hosts =\> "localhost:9200"  
index =\> "crsi-index-template-%{+yyyy.MM.dd}"  
document\_id =\> "%{[transaction\_id]}"  
action =\> "update"  
doc\_as\_upsert =\> true  
}

stdout {}  
}

yestarday I populated elastic data with three documents, so in the index "crsi-index-template-2021.09.07", today I've tried to update one of these documents with an existing "transaction\_id" and logstash has created a new document insted to update it.

 ![Untitled](https://us1.discourse-cdn.com/elastic/original/3X/a/d/ad40d11232dccf664ce6311cd163b2f0f5d5b5c9.png)

I can't understand why, someone can hel me on this?

regards.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 8, 2021, 1:20pm UTC](https://discuss.elastic.co/t/logstash-not-update-a-document-even-if-document-id-is-specified/283660/2 "2021-09-08T13:20:38Z")

</div>

If I'm not wrong, the `_id` is not unique across indices and since you are using a time based index you seem to have 2 indices.

The first one is `crsi-index-template-2021.09.07` and the second one is `crsi-index-template-2021.09.08`, so you didn't updated a document, you create another document with the same `_id` in another index.

---

<div class="post-metadata">

**Author:** ![reed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reed/32/122863_2.png) [@reed](https://discuss.elastic.co/u/reed)\
**Post date:** [September 8, 2021, 2:06pm UTC](https://discuss.elastic.co/t/logstash-not-update-a-document-even-if-document-id-is-specified/283660/3 "2021-09-08T14:06:23Z")

</div>

Hi, thanks for the fast responde.

so if I want to update the same document I need to have always the same index?

There is no way to update the document in my configuration?

thanks.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 8, 2021, 2:23pm UTC](https://discuss.elastic.co/t/logstash-not-update-a-document-even-if-document-id-is-specified/283660/4 "2021-09-08T14:23:15Z")

</div>

You would need to use a filter in your pipeline to query your elasticsearch using this id and get the correct index name, but depending on the number the events this could be expensive to your cluster.

What does your document looks like? I see that you have a `Time` field with a date, normally this is the date that should be used when create the index, so your document would be stored in the index `crsi-index-template-2020.12.10` and it would update as the date is the same, but you seems to be using the `@timestamp` generated by logstash during ingestion.

If you could use the document date instead, this would solve your update problemas as the date would be the same and would direct to the same index.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 6, 2021, 2:23pm UTC](https://discuss.elastic.co/t/logstash-not-update-a-document-even-if-document-id-is-specified/283660/5 "2021-10-06T14:23:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.