# Status 404 on update

**URL:** <https://discuss.elastic.co/t/status-404-on-update/96432>\
**Category:** Logstash\
**Created:** [August 9, 2017, 12:31pm UTC](https://discuss.elastic.co/t/status-404-on-update/96432 "2017-08-09T12:31:31Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![bterhorst](https://avatars.discourse-cdn.com/v4/letter/b/c57346/32.png) [@bterhorst](https://discuss.elastic.co/u/bterhorst)\
**Post date:** [August 9, 2017, 12:31pm UTC](https://discuss.elastic.co/t/status-404-on-update/96432/1 "2017-08-09T12:31:31Z")

</div>

Hi,

I have a document that is inserted into elasticsearch under the index: `index-%{+YYYY.MM.dd}`  
where %{+YYYY.MM.dd}=2017-08-09  
A day later another event comes in and I have to update that document I inserted yesterday.

When trying to update I get a status 404 meaning it cannot find that record is my guess.  
When the inserted document is updated on the same day and thus also under the same index it finds it and updates it without any errors.

How can I get hold of the index for the document I am trying to update so that I can dynamically use it in the output when updating?

Regards benny

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 11, 2017, 7:26am UTC](https://discuss.elastic.co/t/status-404-on-update/96432/2 "2017-08-11T07:26:52Z")

</div>

You can use an elasticsearch filter to locate the original document. The filter has options to save metadata like the index name into fields that you can use later on in the elasticsearch output.

---

<div class="post-metadata">

**Author:** ![bterhorst](https://avatars.discourse-cdn.com/v4/letter/b/c57346/32.png) [@bterhorst](https://discuss.elastic.co/u/bterhorst)\
**Post date:** [August 11, 2017, 8:43am UTC](https://discuss.elastic.co/t/status-404-on-update/96432/3 "2017-08-11T08:43:05Z")

</div>

Hi Magnus,

I tried what you suggested but for some reason I get a "nil" when I copy that field to my new field current\_index:

```
elasticsearch {
		hosts => ["localhost:9200"]
		index => "portal-*"
		query => "ORDER_ID:%{ORDER_ID}"
		fields => { "message" => "message" }
		fields => { "_index" => "current_index" }
}

```

This is the result when I send the output of that field to a log file: `"current_index" => nil`  
I also tried it without the underscore.  
Am I using the wrong identifier?

FYI: The message comes through no problem.

Regrads benny

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 11, 2017, 8:51am UTC](https://discuss.elastic.co/t/status-404-on-update/96432/4 "2017-08-11T08:51:04Z")

</div>

This doesn't work because `_index` isn't a field in the original document. Unfortunately I mixed up the elasticsearch index with the elasticsearch filter. The former can add metadata fields like the index name to the event but the filter can't. There's an open pull request to add that , though:

> <https://github.com/logstash-plugins/logstash-filter-elasticsearch/pull/73>

---

<div class="post-metadata">

**Author:** ![bterhorst](https://avatars.discourse-cdn.com/v4/letter/b/c57346/32.png) [@bterhorst](https://discuss.elastic.co/u/bterhorst)\
**Post date:** [August 11, 2017, 9:52am UTC](https://discuss.elastic.co/t/status-404-on-update/96432/5 "2017-08-11T09:52:33Z")

</div>

Hi Magnus,

Do you mean that this is currently not possible and that it will be in a future release?  
Is there a work-around for this problem?

Regards benny

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 11, 2017, 11:11am UTC](https://discuss.elastic.co/t/status-404-on-update/96432/6 "2017-08-11T11:11:42Z")

</div>

> Do you mean that this is currently not possible and that it will be in a future release?

Yes.

> Is there a work-around for this problem?

None that I can think of now.

---

<div class="post-metadata">

**Author:** ![bterhorst](https://avatars.discourse-cdn.com/v4/letter/b/c57346/32.png) [@bterhorst](https://discuss.elastic.co/u/bterhorst)\
**Post date:** [August 11, 2017, 11:31am UTC](https://discuss.elastic.co/t/status-404-on-update/96432/7 "2017-08-11T11:31:31Z")

</div>

Okay, thanks for the reply Magnus!  
I will investigate further.

Regards benny

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2017, 11:32am UTC](https://discuss.elastic.co/t/status-404-on-update/96432/8 "2017-09-08T11:32:17Z")

</div>

Closed on September 8, 2017, 11:32am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.