# Update document while uploading mapping with logstash

**URL:** <https://discuss.elastic.co/t/update-document-while-uploading-mapping-with-logstash/193596>\
**Category:** Logstash\
**Created:** [August 2, 2019, 4:43pm UTC](https://discuss.elastic.co/t/update-document-while-uploading-mapping-with-logstash/193596 "2019-08-02T16:43:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![leeyu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leeyu/32/48561_2.png) [@leeyu](https://discuss.elastic.co/u/leeyu)\
**Post date:** [August 2, 2019, 4:43pm UTC](https://discuss.elastic.co/t/update-document-while-uploading-mapping-with-logstash/193596/1 "2019-08-02T16:43:33Z")

</div>

Hi all,

I have some map for mapping and data on elasticsearch.

My filter plugin is the following

```
elasticsearch{
    hosts => ["localhost:9200"]
    index => "mapping_av"
    query => "signature:%{[id]}"
    result_size => 1
    fields => {"name" => "id_name"}
}

elasticsearch{
    hosts => ["localhost:9200"]
    index => "mapping_device_sn"
    query => "sn:%{[device_sn]}"
    result_size => 1
    fields => {
        "customer" => "customer"
        "warranty_date" => "warranty_date"
    }
}

```

I know that logstash can handle document update.

But is it possible to reach the following functionality when updating the map?

1. Update the missing value in the document.
2. Update the changed value in the document.

In other words, when I use logstash to update the map.

I also want to update the document related to it with the new map.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2019, 4:43pm UTC](https://discuss.elastic.co/t/update-document-while-uploading-mapping-with-logstash/193596/2 "2019-08-30T16:43:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.