Unable to update the elasticsearch document properly


I have this config file where I am trying to update an existing document with matching UUID only if the new document has greater timestamp than previous document. However, the field previoustime never seems to be populated properly or it is empty most of the times. When it does get populated, it gets populated from completely different document.

'input {beats{port => 5044}} filter{json{source => "message"}elasticsearch{hosts => [""] query => "_id={[uuid]}" index => "uuid39" fields => {"publishedtime" => "previoustime"}}} output {if[key] == "elasticsearch" and [previoustime] {if[previoustime] < [publishedtime]{ elasticsearch { hosts => [""] index => "uuid39" document_id => "%{[uuid]}" }}}else if[key] == "elasticsearch"{elasticsearch {hosts => [""] document_id => "%{[uuid]}" index => "uuid39" }}else{}}'

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.