# Logstash upsert partial document

**URL:** <https://discuss.elastic.co/t/logstash-upsert-partial-document/102249>\
**Category:** Logstash\
**Created:** [September 29, 2017, 10:59am UTC](https://discuss.elastic.co/t/logstash-upsert-partial-document/102249 "2017-09-29T10:59:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Justin\_Cross](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/justin_cross/32/104500_2.png) [@Justin\_Cross](https://discuss.elastic.co/u/Justin_Cross)\
**Post date:** [September 29, 2017, 10:59am UTC](https://discuss.elastic.co/t/logstash-upsert-partial-document/102249/1 "2017-09-29T10:59:38Z")

</div>

I have an index that contains some documents where field that are null and eventually once another particular row comes that has data for these fields, I want to upsert all old documents containing a particular document id with the same data that this new row has for the null fields.

So basically in event A the field 'system' is null, in event B that comes later for this same id it has a 'system' value, so while inserting the row B into elasticsearch I also want it to update row A'system' field.

Is this possible or not within logstash using the output elasticsearch?

```
elasticsearch{
    hosts=> ["X:9200"]
    index => "search-%{record_date}"
    document_id => "%{id}"
    action => "update"
    doc_as_upsert => true
    workers => 4
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 17, 2017, 5:45pm UTC](https://discuss.elastic.co/t/logstash-upsert-partial-document/102249/2 "2017-10-17T17:45:28Z")

</div>

Yes, this should be possible. How are you setting the `id` field which is used as the document id?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 14, 2017, 5:45pm UTC](https://discuss.elastic.co/t/logstash-upsert-partial-document/102249/3 "2017-11-14T17:45:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.