Update data in Elastic with Filebeats

Elastic Stack Beats
1

I have some data from our Monitoring tool that is uploaded to Elastic with Filebeats. When the monitoring alert is closed, I get a new entry with "Resolution state: Closed" I would like to update the Resolution state in Elastic, instead of creating an new (double) entry, with only one field changed.

In this topic I found some information about that. I have to make sure that I have a unique ID that I can use to relate the 2 entries.

So with the help of this forum, I managed to change the Document Id, by adding this to the filebeat.yml

filebeat.inputs:
  parsers:
    - ndjson:
        document_id: "AlertId"

I can verify that the Document Id now is correct, and not generated by Elastic anymore. But when I have a closed alert, nothing seems to happen. So it doesn't get uploaded twice anymore, but it's also not updating.

Any help with figuring this problem out would be appreciated! I have no clue anymore.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.