Prevent upsert to merge internal objects in logstash configuration

Elastic Stack Logstash
1

consider this record is stored in elastic search :

 { 
"id" : 1
"Name" : "a",
"Obj" : { "old" : 123 }
}

and i want to update that record by this :

{
"id" : 1
"Family" : "b",
"Obj" : { "new": 321 }
}

finally i want to this record to be exist in elastic :

 {
"id" : 1
"Name" : "a",
"Family" : "b",
"Obj" : { "new" : 321 }
}

but i've got this in real :

 {
"id" : 1
"Name" : "a",
"Family" : "b",
"Obj" : { **"old": 123** , "new" : 321 }
}

my logstash config is :

{
...
output {
  stdout {}
  elasticsearch { 
	hosts => ["localhost:9200"]
	index => "test" 
	action => "update"
	doc_as_upsert => true
	document_id => "%{id}"
  }
}

i even tried to remove that field ( Obj ) by script :

...
action => "update"
doc_as_upsert => true
**script => "ctx._source.remove('Obj')"**
...

but it removed after update action and this record will appear in elastic :

 {
"id" : 1
"Name" : "a",
"Family" : "b"
}

and replacement the field by script did not work :

...
action => "update"
doc_as_upsert => true
**script => "ctx._source.Obj = doc[Obj]"**
...

got this error in logstash :
Variable [Obj] is not defined
is there any idea to prevent upsert operation from merge obj field ?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.