# Problems doing an \_update\_by\_query with the logstash http output plugin **URL:** \ **Category:** Logstash\ **Created:** [July 8, 2018, 2:17pm UTC](https://discuss.elastic.co/t/problems-doing-an-update-by-query-with-the-logstash-http-output-plugin/139057 "2018-07-08T14:17:08Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Efrain\_Gonzalez](https://avatars.discourse-cdn.com/v4/letter/e/9f8e36/32.png) [@Efrain\_Gonzalez](https://discuss.elastic.co/u/Efrain_Gonzalez)\ **Post date:** [July 8, 2018, 2:17pm UTC](https://discuss.elastic.co/t/problems-doing-an-update-by-query-with-the-logstash-http-output-plugin/139057/1 "2018-07-08T14:17:08Z")
Using kibana's Dev tools I have a working REST api call ``` POST /unicast-prefixes-x.x.x.x/_update_by_query { "script" : { "source" : "if (ctx._source.containsKey('tags')) { ctx._source.tags.add('test3') } else { ctx._source.tags = ['test3'] }" }, "query" : { "bool" : { "must" : [ { "match" : { "TYPE" : "unicast-prefix" }} ], "filter" : [ { "range" : { "@timestamp" : { "lt" : "now" } } } ] } } } ``` With the following result... { "took": 958, "timed\_out": false, "total": 2396, "updated": 2396, "deleted": 0, "batches": 3, "version\_conflicts": 0, "noops": 0, "retries": { "bulk": 0, "search": 0 }, "throttled\_millis": 0, "requests\_per\_second": -1, "throttled\_until\_millis": 0, "failures": [] } But I'm trying to implement the same API call through a logstash http output plugin and I'm having the following error in logstash. [2018-07-08T14:09:09,933][ERROR][logstash.outputs.http] [HTTP Output Failure] Encountered non-2xx HTTP code 400 {:response\_code=\>400, :url=\>"[http://elasticsearch:9200/unicast-prefixes-x.x.x.x/\_search](http://elasticsearch:9200/unicast-prefixes-x.x.x.x/_search)", :event=\>#LogStash::Event:0x37c85594} The logstash config is ``` http { format => "json" http_method => "post" url => "http://elasticsearch:9200/unicast-prefixes-%{[remote_ip]}/_update_by_query" message => '{ "script" : { "source" : "if (ctx._source.containsKey('tags')) { ctx._source.tags.add('test3') } else { ctx._source.tags = ['test3'] }" }, "query" : { "bool" : { "must" : [ { "match" : { "TYPE" : "unicast-prefix" }} ], "filter" : [ { "range" : { "@timestamp" : { "lt" : "now" } } } ] } } }' } ``` Not sure what I'm doing wrong ... escaping quotes, is this a support API call for the plugin?? PS: I did the test with and without "config.support\_escapes: true" in the logstash config, but same result. Could someone help me please. thanks ---
**Author:** ![Efrain\_Gonzalez](https://avatars.discourse-cdn.com/v4/letter/e/9f8e36/32.png) [@Efrain\_Gonzalez](https://discuss.elastic.co/u/Efrain_Gonzalez)\ **Post date:** [July 10, 2018, 1:15pm UTC](https://discuss.elastic.co/t/problems-doing-an-update-by-query-with-the-logstash-http-output-plugin/139057/2 "2018-07-10T13:15:22Z")
I enabled traces on elasticsearch and I got this error when the api call is executed. org.elasticsearch.common.ParsingException: Unknown key for a VALUE\_STRING in [error\_text]. ---
**Author:** ![Efrain\_Gonzalez](https://avatars.discourse-cdn.com/v4/letter/e/9f8e36/32.png) [@Efrain\_Gonzalez](https://discuss.elastic.co/u/Efrain_Gonzalez)\ **Post date:** [July 10, 2018, 2:25pm UTC](https://discuss.elastic.co/t/problems-doing-an-update-by-query-with-the-logstash-http-output-plugin/139057/3 "2018-07-10T14:25:03Z")
My problem seems quite similar to the one reported here.... > [@How to update a document in elasticsearch with logstash http output plugin](https://discuss.elastic.co/t/how-to-update-a-document-in-elasticsearch-with-logstash-http-output-plugin/107995): > > Hi all.... Here i am trying to update a document in elasticsearch with the help of output logstash http plugin here is my logstash conf input { elasticsearch { hosts =\> "192.168.1.59:9233" index =\> "titanic\_kfk\_shrink" query =\> '{ "query":{ "match" : { "PassengerId" : "200" } }, "sort": ["\_doc"] }' size =\> 5000 scroll =\> "5m" docinfo =\> true docinfo\_target =\> "@metadata" } } output { stdout { codec =\> rubydebug { metadata =\> true } }… Regards ---
**Author:** ![Efrain\_Gonzalez](https://avatars.discourse-cdn.com/v4/letter/e/9f8e36/32.png) [@Efrain\_Gonzalez](https://discuss.elastic.co/u/Efrain_Gonzalez)\ **Post date:** [July 11, 2018, 10:58am UTC](https://discuss.elastic.co/t/problems-doing-an-update-by-query-with-the-logstash-http-output-plugin/139057/4 "2018-07-11T10:58:48Z")
I found a workaround using exec plugin and 'curl', ``` exec { command => " curl -X POST \"http://elasticsearch:9200/unicast-prefixes-%{[remote_ip]}/_update_by_query?conflicts=proceed\" -H 'Content-Type: application/json' -d' { \"script\" : { \"source\" : \"if (ctx._source.containsKey(params.t1)) { if (!ctx._source.tags.contains(params.t2)) { ctx._source.tags.add(params.t2) } } else { ctx._source.tags = [params.t2] }\", \"params\" : { \"t1\" : \"tags\", \"t2\" : \"withdrawn\" } }, \"query\" : { \"bool\" : { \"must\" : [ { \"match\" : { \"TYPE\" : \"unicast-prefix\" }} ], \"filter\" : [ { \"range\" : { \"@timestamp\" : { \"lt\" : \"now\" } } } ] } } }' " } } ``` Doing troubleshooting with curl, it was almost imposible to scape the 'tags' on (ctx.\_source.containsKey('tags')), and I use as workaround the params. So, now that we have a working environment, we need to try again with http output plugin to make the most clean solution. Regards ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 8, 2018, 10:59am UTC](https://discuss.elastic.co/t/problems-doing-an-update-by-query-with-the-logstash-http-output-plugin/139057/5 "2018-08-08T10:59:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.