Rename doc_id in logstash output

Elastic Stack Logstash
1

i want to sub-string id and ädd it in front of the id with _ and store that as doc_id in es out put.
i tried below but doesn't work

id = %{id}[0..1]+""+%{id}
elasticsearch {
document_id => "%{id}[0..1]+""+%{id}"
}

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.