consider this record is stored in elastic search :
{
"id" : 1
"Name" : "a",
"Obj" : { "old" : 123 }
}
and i want to update that record by this :
{
"id" : 1
"Family" : "b",
"Obj" : { "new": 321 }
}
finally i want to this record to be exist in elastic :
{
"id" : 1
"Name" : "a",
"Family" : "b",
"Obj" : { "new" : 321 }
}
but i've got this in real :
{
"id" : 1
"Name" : "a",
"Family" : "b",
"Obj" : { **"old": 123** , "new" : 321 }
}
my logstash config is :
{
...
output {
stdout {}
elasticsearch {
hosts => ["localhost:9200"]
index => "test"
action => "update"
doc_as_upsert => true
document_id => "%{id}"
}
}
i even tried to remove that field ( Obj ) by script :
...
action => "update"
doc_as_upsert => true
**script => "ctx._source.remove('Obj')"**
...
but it removed after update action and this record will appear in elastic :
{
"id" : 1
"Name" : "a",
"Family" : "b"
}
and replacement the field by script did not work :
...
action => "update"
doc_as_upsert => true
**script => "ctx._source.Obj = doc[Obj]"**
...
got this error in logstash :
Variable [Obj] is not defined
is there any idea to prevent upsert operation from merge obj field ?