There you go:
The easiest solution is to load the document with the same ID to the ES and let it handle the merge there.
input {
http_poller {
urls => {
station_information => "https://gbfs.nextbike.net/maps/gbfs/v1/nextbike_le/de/station_information.json"
station_status => "https://gbfs.nextbike.net/maps/gbfs/v1/nextbike_le/de/station_status.json"
}
request_timeout => 60
schedule => { every => "10s"}
codec => "json"
}
}
filter {
if [data][stations][1]{
split {
field => "[data][stations]"
}
}
fingerprint {
method => "MD5"
concatenate_sources => true
source => ["[stations][station_id]"]
target => ["fingerprint"]
}
}
output {
elasticsearch {
hosts => ["192.168.1.1:9200", "192.168.1.2:9200"]
index => "stations"
action => "update"
document_id => "%{fingerprint}"
}
}
Good luck with your endeavor!

