# SystemDate or time to elasticsearch fields
**URL:** https://discuss.elastic.co/t/systemdate-or-time-to-elasticsearch-fields/86872
**Category:** Logstash
**Created:** [May 23, 2017, 10:09pm UTC](https://discuss.elastic.co/t/systemdate-or-time-to-elasticsearch-fields/86872 "2017-05-23T22:09:01Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Samatha](https://discuss.elastic.co/u/Samatha)
#### Post date: [May 23, 2017, 10:09pm UTC](https://discuss.elastic.co/t/systemdate-or-time-to-elasticsearch-fields/86872/1 "2017-05-23T22:09:01Z")
We are trying to set current system date to one of the elastic field while inserting records using logstash script.
mutate {
add\_field =\> {"logdate" =\> "%{[+YYYY-MM-dd]}"}
}
output {
elasticsearch{
hosts =\> ["localhost:9200"]
"script" =\> '{
"lst\_use\_dt" =\> "%{[logdate]}"
}'
}
}
But its not inserting/updating anything to lst\_use\_dt field.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 28, 2017, 6:37pm UTC](https://discuss.elastic.co/t/systemdate-or-time-to-elasticsearch-fields/86872/2 "2017-05-28T18:37:30Z")
> add\_field =\> {"logdate" =\> "%{[+YYYY-MM-dd]}"}
This syntax is wrong. Remove the angle brackets to populate the `logdate` field with a YYYY-MM-dd date from on the `@timestamp` field.
> "script" =\> '{
> "lst\_use\_dt" =\> "%{[logdate]}"
> }'
This isn't a valid script. I'm not even sure what you're trying to do here.
---
### Author:  [@Samatha](https://discuss.elastic.co/u/Samatha)
#### Post date: [June 2, 2017, 5:55pm UTC](https://discuss.elastic.co/t/systemdate-or-time-to-elasticsearch-fields/86872/3 "2017-06-02T17:55:39Z")
Hi Magnus,
We have an index with fields iss\_id, cntry\_cde, financial\_inst, create\_dt, update\_date, exp\_dt.
And we are receiving a data file from other team with values for the fields iss\_id, cntry\_cde, financial\_inst only.
So our requirement is to insert the records if they are not already exists in ElasticSearch including other fields like create\_dt, update\_date, exp\_dt where create\_dt and update\_dt holds sysdate and exp\_dt as 12-12-9999 00:00:000
If record already exists then we have update the record with the values from data file and also only update update\_dt to sysdate not touching create\_dt and exp\_dt.
We tried to use script and upsert but it didn't work. So we need help in implementing this requirement.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 3, 2017, 3:00pm UTC](https://discuss.elastic.co/t/systemdate-or-time-to-elasticsearch-fields/86872/4 "2017-06-03T15:00:36Z")
If you strictly want to update existing documents but never create documents you probably have to use an elasticsearch filter to obtain the current document (if it exists), update its contents, and send it back with an elasticsearch output. I haven't tried anything like that myself.
---
### Author:  [@Samatha](https://discuss.elastic.co/u/Samatha)
#### Post date: [June 6, 2017, 2:00pm UTC](https://discuss.elastic.co/t/systemdate-or-time-to-elasticsearch-fields/86872/5 "2017-06-06T14:00:01Z")
> [@magnusbaeck](#):
>
> If you strictly want to update existing documents but never create documents you probably have to use an elasticsearch filter to obtain the current document (if it exists), update its contents, and send it back with an elasticsearch output. I haven't tried anything like that myself.
Hi Magnus,
Thanks for the information. Could you please give me some examples on how to read existing document from Elasticsearch and update the same with new values from the input file?
Thanks in advance.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 7, 2017, 5:53am UTC](https://discuss.elastic.co/t/systemdate-or-time-to-elasticsearch-fields/86872/6 "2017-06-07T05:53:51Z")
Did you look at the example in the elasticsearch filter documentation?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 6:07am UTC](https://discuss.elastic.co/t/systemdate-or-time-to-elasticsearch-fields/86872/7 "2017-07-05T06:07:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.