Update document and concatenate field with Logstash

Elastic Stack Logstash
1

Hello,

We would like to update a document using Logstash but one of our field should be concatenante and not replace by the new one.

Example, if we have two lines to insert :

{"state" => "created", "data" => "firstData"}
{"state" => "sent", "data" => "SecondData"}

Actually the result is :

"_id" => 1
"version" => 2
"state" => "sent"
"data" => "SecondData"

The wished result is :

"_id" => 1
"version" => 2
"state" => "sent"
"data" => "FirstData, SecondData"

How can we perform this kind of update ?

Elasticsearch version :
7.16

Regards,
Thomas

2

logstash treat these as two separate event.
in my view you can't do what you like unless you sent them as one event.