# Sending new fields to exisiting Elastic document, losing old data

**URL:** <https://discuss.elastic.co/t/sending-new-fields-to-exisiting-elastic-document-losing-old-data/206992>\
**Category:** Logstash\
**Created:** [November 7, 2019, 4:46pm UTC](https://discuss.elastic.co/t/sending-new-fields-to-exisiting-elastic-document-losing-old-data/206992 "2019-11-07T16:46:42Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![EdgeSync](https://avatars.discourse-cdn.com/v4/letter/e/90ced4/32.png) [@EdgeSync](https://discuss.elastic.co/u/EdgeSync)\
**Post date:** [November 7, 2019, 5:30pm UTC](https://discuss.elastic.co/t/sending-new-fields-to-exisiting-elastic-document-losing-old-data/206992/2 "2019-11-07T17:30:07Z")

</div>

I have solved it myself 😃

based on this post: [doc\_as\_upsert vs upsert properties](https://discuss.elastic.co/t/update-ops-doc-as-upsert-vs-upsert-properties/14108)

It was required to make it an upsert.

so my logstash config looks something like this

> input {  
> udp {  
> port =\> 10001  
> codec =\> json  
> }  
> }
> 
> filter {  
> fingerprint {  
> source =\> "id"  
> target =\> "[@metadata][fingerprint]"  
> method =\> "MURMUR3"  
> }  
> }
> 
> output {  
> elasticsearch {  
> hosts =\> ["[https://127.0.0.1:9200](https://127.0.0.1:9200)"]  
> user =\> "logstash\_account"  
> password =\> "some\_password\_here"  
> cacert =\> "/etc/logstash/conf.d/cacert.cer"  
> ssl\_certificate\_verification =\> false  
> document\_id =\> "%{[@metadata][fingerprint]}"  
> index =\> "some\_index"  
> doc\_as\_upsert =\> true  
> action =\> update  
> }  
> }

---

_[View the full topic](https://discuss.elastic.co/t/sending-new-fields-to-exisiting-elastic-document-losing-old-data/206992)._