# Maintaining split events using document id **URL:** \ **Category:** Logstash\ **Created:** [November 4, 2016, 6:23am UTC](https://discuss.elastic.co/t/maintaining-split-events-using-document-id/64986 "2016-11-04T06:23:14Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Grid32](https://avatars.discourse-cdn.com/v4/letter/g/4bbf92/32.png) [@Grid32](https://discuss.elastic.co/u/Grid32)\ **Post date:** [November 4, 2016, 6:23am UTC](https://discuss.elastic.co/t/maintaining-split-events-using-document-id/64986/1 "2016-11-04T06:23:14Z")
My Logstash config file that I'm using currently uses a split filter to break the event into several different events. These are then sent to ElasticSearch to store as documents. The question is how do we maintain the index after the initial ingestion? Currently the document id is the primary key coming from a database. We're looking at just appending an event split number to the primary key, then using that as the document id. Eg. Item 001 might be split into 3 events, and thus we would ingest them with document ids 001-1, 001-2 and 001-3. Any recommendations on how to do this, or as to a better solution? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 6, 2016, 3:40am UTC](https://discuss.elastic.co/t/maintaining-split-events-using-document-id/64986/2 "2016-11-06T03:40:22Z")
Do you want to keep the older documents around? If not then use the same ID and just overwrite. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:30am UTC](https://discuss.elastic.co/t/maintaining-split-events-using-document-id/64986/3 "2017-07-06T04:30:53Z")
Closed on July 6, 2017, 4:30am UTC