# Logstash partial updates

**URL:** <https://discuss.elastic.co/t/logstash-partial-updates/56378>\
**Category:** Logstash\
**Created:** [July 26, 2016, 10:00am UTC](https://discuss.elastic.co/t/logstash-partial-updates/56378 "2016-07-26T10:00:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lorello](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lorello/32/9909_2.png) [@lorello](https://discuss.elastic.co/u/lorello)\
**Post date:** [July 26, 2016, 10:00am UTC](https://discuss.elastic.co/t/logstash-partial-updates/56378/1 "2016-07-26T10:00:00Z")

</div>

Can logstash run partial updates reading from a logfile?

Example: index contains fields ID (used as document id), NAME, VALUE

I read data from a logfile made of json lines and containing updates on the same records

{ "id": "1", "name": "Aldo", "value": "1111" }  
{ "id": "2", "name": "Giovanni", "value": "2222" }  
{ "id": "3", "name": "Giacomo", "value": "3333" }  
{ "id": "1", "name": "Aldo", "value": "4444" }

I'm trying to manage lines containing only a subset of fields, like:  
{ "id": "1", "value": "5555" }

This does not update the document with ID=1, can someone confirm that Logstash cannot manage partial updates of documents?

Thanks,  
L

---

<div class="post-metadata">

**Author:** ![DiscussBuster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/discussbuster/32/11042_2.png) [@DiscussBuster](https://discuss.elastic.co/u/DiscussBuster)\
**Post date:** [July 27, 2016, 3:19am UTC](https://discuss.elastic.co/t/logstash-partial-updates/56378/2 "2016-07-27T03:19:20Z")

</div>

Have you looked at the documentation for the elasticsearch output plugin, and looked for "update"?

---

<div class="post-metadata">

**Author:** ![lorello](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lorello/32/9909_2.png) [@lorello](https://discuss.elastic.co/u/lorello)\
**Post date:** [July 27, 2016, 7:22am UTC](https://discuss.elastic.co/t/logstash-partial-updates/56378/3 "2016-07-27T07:22:24Z")

</div>

Yes,  
I can update records with logstash if the log has all of the fields of the document, but I'm not able to update a single field of a record, I'm missing something or is not supported?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:46am UTC](https://discuss.elastic.co/t/logstash-partial-updates/56378/4 "2017-07-06T04:46:20Z")

</div>