Querying elasticsearch for doc id

Elastic Stack Logstash
1

Hi all,

I have logstash configuration and I'm trying to get the "_id" of a document that answer to some terms (using elasticsearch filter)

for example:
i did a grok filter and now i have values for testA and testB and i want to see if i already index it if i did i want to do something (the point is getting the id)

query => "type:test AND testA:%{testA} AND testB:%{testB}"
here I have (or haven't) the doc with this details but can't get the id of it

2

See if you can use the elasticsearch filter. A more efficient way would be to generate the id based on certain field values. Then you don't have to check for the existence of the correct document, you can just index the current document which then may or may not overwrite the existing one.

3

@magnusbaeck I am using the es filter but i can't get from the query the _id of the doc so when i will do 'update' action on es output i will have the specific id to use.

how i can get the _id value using es filter?

4

Ah. Yes, I guess the id isn't available in the source document itself and therefore isn't made available through this plugin. It seems reasonable to be able to obtain the id of matching documents, though. Feel free to file a GitHub issue: https://github.com/logstash-plugins/logstash-filter-elasticsearch/issues/new