# Update by query in Logstash

**URL:** <https://discuss.elastic.co/t/update-by-query-in-logstash/292333>\
**Category:** Logstash\
**Tags:** painless\
**Created:** [December 17, 2021, 4:09pm UTC](https://discuss.elastic.co/t/update-by-query-in-logstash/292333 "2021-12-17T16:09:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pablo\_Albertengo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pablo_albertengo/32/47685_2.png) [@Pablo\_Albertengo](https://discuss.elastic.co/u/Pablo_Albertengo)\
**Post date:** [December 17, 2021, 4:09pm UTC](https://discuss.elastic.co/t/update-by-query-in-logstash/292333/1 "2021-12-17T16:09:30Z")

</div>

Hi!  
I'm trying to solve the following problem.  
I have some information in the database that I want to send to an Elasticsearch index through Logstash.  
It is something that I have already done on some occasion but the problem in this case is that the id of the index is auto-generated by Elasticsearch, so I cannot perform the update action through the id.

I would need something similar to functionality

> **[Update By Query API | Elasticsearch Guide \[7.16\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-update-by-query.html)**

but I understand that the plugin for elastic

> **[Elasticsearch output plugin | Logstash Reference \[7.16\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html)**

can not stand it. Is that correct?

In this link an alternative is mentioned using the http plugin:

> <https://stackoverflow.com/questions/53330232/does-logstash-support-elasticsearchs-update-by-query>

but I'm not sure how to perform this in my scenario.

The post I should make is something like this:

```auto
POST myindex/_update_by_query
{
  "script": {
    "source": "ctx._source.itemValue = params.itemValue",
    "lang": "painless",
    "params": {
      "itemValue": "itemValue"
    }
  },
  "query": {
    "term": {
      "myField": "myField"
    }
  }
}

```

How can I send the results of my query being that I should perform a POST for each retrieved row.  
It's possible?  
Should I do it in another way?

I upload a pseudo configuration to graph the problem.

```auto
input {
  jdbc {
    jdbc_driver_class => ""
    jdbc_driver_library => ""
    jdbc_connection_string => ""
    jdbc_user => ""
    jdbc_password => ""
    jdbc_paging_enabled => true
    schedule => ""
    statement => "SELECT A as myField, B AS valueToUpdate FROM TABLE"
  }
}
filter {
  mutate {
    add_field => {
      "[script] [lang]" => "painless"
      "[script] [source]" => "ctx._source.itemValue = params.itemValue"
      "[script] [params] [itemValue]" => // This should go from the valueToUpdate field retrieved from the database
      "[query] [term] [myField]" => // Here should go the information of the myField field retrieved from the database
    }
    remove_field => [""]
  }
}
output {
  http {
    url => "http://IP:9200/index/doc/_update_by_query"
    http_method => "post"
    format => "json"
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 14, 2022, 4:10pm UTC](https://discuss.elastic.co/t/update-by-query-in-logstash/292333/2 "2022-01-14T16:10:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.