# Logstash Update a document in elasticsearch
**URL:** https://discuss.elastic.co/t/logstash-update-a-document-in-elasticsearch/74039
**Category:** Logstash
**Created:** [February 6, 2017, 10:12am UTC](https://discuss.elastic.co/t/logstash-update-a-document-in-elasticsearch/74039 "2017-02-06T10:12:41Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@banu](https://discuss.elastic.co/u/banu)
#### Post date: [February 6, 2017, 10:12am UTC](https://discuss.elastic.co/t/logstash-update-a-document-in-elasticsearch/74039/1 "2017-02-06T10:12:41Z")
Trying to update a specific field in elasticsearch through logstash. Is it possible to update only a set of fields through logstash ?
Please find the code below,
filter {
csv {
separator =\> "|"
columns =\> ["NAME","ID","COUNTRYNAME","DATE","STATECODE", "G\_NAME","G\_ID","G\_COUNTRYNAME","
G\_DATE","G\_STATECODE"]
}
ruby {
code =\> "
hash = event.to\_hash
hash.each do |k,v|
if v == nil
event.remove(k)
end
end
"
}
}
We are using the above configuration when we use this the null value field is getting removed instead of skipping null value update.
Sample Complete document log input
John|892|Canada|31-01-2017|QC
Updating a document with null value should not remove the field instead the null value fields should be skipped and the reside with existing date 31-01-2017 value. John|892|Canada||QC
---
### Author:  [@pjanzen](https://discuss.elastic.co/u/pjanzen)
#### Post date: [February 6, 2017, 10:15am UTC](https://discuss.elastic.co/t/logstash-update-a-document-in-elasticsearch/74039/2 "2017-02-06T10:15:44Z")
Hi,
yes this is possible, you have to set action =\> 'update' in your elasticsearch output.
You have to remember that this will severly impact you elasticsearch cluster so handle with care.
Paul.
---
### Author:  [@banu](https://discuss.elastic.co/u/banu)
#### Post date: [February 6, 2017, 10:22am UTC](https://discuss.elastic.co/t/logstash-update-a-document-in-elasticsearch/74039/3 "2017-02-06T10:22:59Z")
how to achieve ?can you tell me the sample configuration
---
### Author:  [@banu](https://discuss.elastic.co/u/banu)
#### Post date: [February 6, 2017, 10:29am UTC](https://discuss.elastic.co/t/logstash-update-a-document-in-elasticsearch/74039/4 "2017-02-06T10:29:39Z")
I have updated like this but i am not getting proper results
filter {
csv {
separator =\> "|"
columns =\> ["NAME","ID","COUNTRYNAME","DATE","STATECODE", "G\_NAME","G\_ID","G\_COUNTRYNAME","
G\_DATE","G\_STATECODE"]
}
mutate {
update =\> { "COUNTRYNAME" =\> "qqqqqqq" }
}
}
---
### Author:  [@pjanzen](https://discuss.elastic.co/u/pjanzen)
#### Post date: [February 6, 2017, 10:31am UTC](https://discuss.elastic.co/t/logstash-update-a-document-in-elasticsearch/74039/5 "2017-02-06T10:31:28Z")
EDIT: I for to mention that you need to generate your own document\_id and set that. So in order to update a existing document you need to set a id on the initial document and reuse that. (bad example: ie: email\_address) or query ES for the document\_id using the logstash-filter-elasticsearch plugin.
It will look something like this.
```
output {
elasticsearch {
host => 'your es host'
action => 'update'
document_id => 'your generated document id'
index => 'your index name
}
}
```
[https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-action](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-action)
---
### Author:  [@banu](https://discuss.elastic.co/u/banu)
#### Post date: [February 6, 2017, 10:51am UTC](https://discuss.elastic.co/t/logstash-update-a-document-in-elasticsearch/74039/6 "2017-02-06T10:51:21Z")
output {
elasticsearch {
hosts =\> ["localhost:9200"]
action =\> "update"
index =\> "logstash-data-monitor"
document\_id =\> "%{DOC\_ID}%"
}
}
This is what we already have. When we try to update it the entire document is getting updated instead of updating a single field. How to achieve this ?
---
### Author:  [@pjanzen](https://discuss.elastic.co/u/pjanzen)
#### Post date: [February 6, 2017, 10:56am UTC](https://discuss.elastic.co/t/logstash-update-a-document-in-elasticsearch/74039/7 "2017-02-06T10:56:03Z")
I am not really sure what you mean here...
With this configuration you should be able to update a single field or any fields send to ES.
For example, you have field A, B and C and you send a doc with a updated field A it leaves B and C alone and it updates A and it will update you document @Version (but thats arbitrary)
Is this not what happens?
---
### Author:  [@banu](https://discuss.elastic.co/u/banu)
#### Post date: [February 6, 2017, 10:58am UTC](https://discuss.elastic.co/t/logstash-update-a-document-in-elasticsearch/74039/8 "2017-02-06T10:58:05Z")
yeah this is not happening. can you suggest us on this ?
---
### Author:  [@pjanzen](https://discuss.elastic.co/u/pjanzen)
#### Post date: [February 6, 2017, 11:03am UTC](https://discuss.elastic.co/t/logstash-update-a-document-in-elasticsearch/74039/9 "2017-02-06T11:03:30Z")
Sorry I cannot help. I have used a similar config and it updated the fields which I needed... if that does not work for you then I am lost to...
---
### Author:  [@banu](https://discuss.elastic.co/u/banu)
#### Post date: [February 6, 2017, 11:05am UTC](https://discuss.elastic.co/t/logstash-update-a-document-in-elasticsearch/74039/10 "2017-02-06T11:05:25Z")
Can you share the complete document which you have used for updating. A sample one which we could use to compare with our code.
---
### Author:  [@banu](https://discuss.elastic.co/u/banu)
#### Post date: [February 6, 2017, 11:16am UTC](https://discuss.elastic.co/t/logstash-update-a-document-in-elasticsearch/74039/11 "2017-02-06T11:16:45Z")
Can you please help on how to check null condition for a field if not null then update the values ?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 6, 2017, 11:16am UTC](https://discuss.elastic.co/t/logstash-update-a-document-in-elasticsearch/74039/12 "2017-03-06T11:16:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.