Hi As per this post it is not advisable to bring your own _id to elasticsearch.
I have inherited a shared windows (horror of all the horrors) drive as a source of log file and already see re-ingestion happening occasionally when using filebeats. However I have GUID as one of the fields.
I was thinking of using it as _id so that the event gets overwritten on an accidental re-ingest (Rather than ending up as a duplicate event).
The key thing is that I am not going to do a lookup. It will be a blind overwriting. At least from my point of view. Is there anyway I can instruct Elasticsearch not to try to look up for that document behind the scene and just fire a write command?