Hi
I populate ELK database reading log files by logstash.
Each document is populated using many log rows, each one inserts specific fileds.
When logstash read a specific action, it update a boolean filed "action_done" to true and it works perfectly.
Now, I'd like to have another field that counts number of occurrences of action.
So I write a script in elasticsearch output in this way:
if [action] == 'my action' {
elasticsearch {
hosts => [ "my_host" ]
user => "logstash_user"
password => "logstash_pwd"
ssl => false
manage_template => true
template_overwrite => true
template_name => "mytemplate"
template => "my-template.json"
id => "specific_output_id"
index => "my_index"
action => "update"
doc_as_upsert => true
document_id => "my_id"
script_type => "inline"
script_lang => ""
script => "if (ctx._source.action_counter == null) { ctx._source.action_counter = 1 } else { ctx._source.action_counter++ }"
}
} else {
elasticsearch {
hosts => [ "my_host" ]
user => "logstash_user"
password => "logstash_pwd"
ssl => false
manage_template => true
template_overwrite => true
template_name => "mytemplate"
template => "my-template.json"
id => "my_output_id"
index => "my_index"
action => "update"
doc_as_upsert => true
document_id => "my_id"
}
}
With this new output configuration, action_counter is almost always not present in the documents and it never has the correct value.
Also action_done field is not always set to true.
Where is the error?
Thanks in advance