Logstash partial updates

Can logstash run partial updates reading from a logfile?

Example: index contains fields ID (used as document id), NAME, VALUE

I read data from a logfile made of json lines and containing updates on the same records

{ "id": "1", "name": "Aldo", "value": "1111" }
{ "id": "2", "name": "Giovanni", "value": "2222" }
{ "id": "3", "name": "Giacomo", "value": "3333" }
{ "id": "1", "name": "Aldo", "value": "4444" }

I'm trying to manage lines containing only a subset of fields, like:
{ "id": "1", "value": "5555" }

This does not update the document with ID=1, can someone confirm that Logstash cannot manage partial updates of documents?


Have you looked at the documentation for the elasticsearch output plugin, and looked for "update"?

I can update records with logstash if the log has all of the fields of the document, but I'm not able to update a single field of a record, I'm missing something or is not supported?