Logstash The order of synchronized data fields is inconsistent with the source end

[haimaren]

My Logstash Configuration

input {
     elasticsearch {
       hosts => "http://172.19.23.12:9200"
       index => "*"
       size => 1000
       scroll => "5m"
       docinfo => true
     }
   }

filter {
    mutate {
        remove_field => ["@timestamp", "@version"]
    }
}

output {
      elasticsearch {
        hosts => "http://elasticsearch-master.camunda.svc.cluster.local:9200"
        index => "%{[@metadata][_index]}"
        document_type => "%{[@metadata][_type]}"
        document_id => "%{[@metadata][_id]}"
  }
}

Here are the results after synchronization:

but The result I want is that the migrated data is exactly the same

[sholzhauer]

Hi,

From what I can see your data is actually the same, json does not guarantee the order of fields is the same throughout its handling. BUT the nested DO remains the same.

So in you example, the key value.elementId exists on both sides (left and right). That means there is no impact on how elasticsearch is aware of your data.

Conclusion: I don't see a difference from elasticsearch perspective.