Pointing index name to alias

Elastic Stack Elasticsearch
1

Hi,

I would like to point alias name in indexing to update a document in multiple daily indices using logstash with the id of the document. But when i provide the alias name it throws error and when i give index name with wildcard (*) character no error but the document is not indexed.

Is there any solution to update documents with additional field in multiple indices by passing the id of the document?

2

What is the exact error that you getting? Can you provide more details?

3

You can run update by query on multiple indices but you can't run update document api on multiple indices.

4

Hi,

How to use update by query in logstash ? I could able to find only update api for logstash.

Should I use http output plugin?

5

Illegal argument exception: alias has more than 1 indice associated with it.

6

I guess so.
Is that a frequent operation actually? I thought it was a one time operation.

7

Yes it is a frequent update on daily basis for old records

8

@Chelambarasan_CR Can you share output of _aliases for your index. I believe you have a single alias connected to multiple physical indices.

9

output {
stdout {
codec => rubydebug
}
elasticsearch {

	hosts => ["localhost:9200"] 

	index => "alias1"
	document_type => "data"
	action => "update"
	document_id => "1"

}
}

10

Can you share the output from below mentioned endpoint?

curl -XGET localhost:9200/_aliases?pretty

11

{
".kibana": {
"aliases": {}
},

"test2": {
"aliases": {
"aliastest": {}
}
},
"test1": {
"aliases": {
"aliastest": {}
}
}
}

aliastest is the alias name

12

output {
stdout {
codec => rubydebug
}
http {

	url => "http:localhost:9200/test1/_update_by_query?q=id:1"
	http_method => "post"
	format => "json"

}
}

Tried this but getting error"Could not able to fetch the url."

Just want to confirm whether the http url for update by query is right?

13

Please format your code, logs or configuration files using </> icon as explained in this guide and not the citation button. It will make your post more readable.

Or use markdown style like:

```
CODE
```

This is the icon to use if you are not using markdown format:

image
image.jpg764×92 16.4 KB

There's a live preview panel for exactly this reasons.

Here the URL seems wrong to me. It should be something like:

url => "http://localhost:9200/test1/_update_by_query?q=id:1"

or

url => "localhost:9200/test1/_update_by_query?q=id:1"
14

Getting this error on removing http`

[HTTP Output Failure] Could not fetch URL {:url=>"localhost:9200/test1/_update_by_query?q=_id:1",

"URI does not specify a valid host name: localhost:9200/test1/_update_by_query?q=_id:1", :class=>"Manticore::ClientProtocolException", :backtrace=>nil,`

15

What about:

url => "http://localhost:9200/test1/_update_by_query?q=id:1"

?

16 
[2019-03-08T16:17:34,642][ERROR][logstash.outputs.http    ] [HTTP Output Failure] Encountered non-2xx HTTP code 400 {:response_code=>400, :url=>"http://localhos
, :will_retry=>false}by_query?q=_id:1", :event=>2019-03-08T10:47:33.712Z CHNMCT123553L 1,samplexml
17

The response is not complete.

Anyway, I'd recommend asking this in #logstash forum instead.

18

ok. opening a thread in logstash

19

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.