Update document with Logstash without updating the @timestamp

Elastic Stack Logstash
1

When I update a document through the Update API, I can change and add fields without updating the timestamp. I am now trying to achieve this with Logstash using the Elasticsearch output action "update" with no success.

My Logstash config:

output {
      elasticsearch {
          hosts => "127.0.0.1"
          index => "%{[index][name]}-%{+yyyy.MM.dd}"
          action => "update"
          # doc_as_upsert => "true"
          document_id => "%{[qs][std_sid]}-%{[qs][std_page_count]}"
       }
}

With this config I want to update an existing document with a partial document.

When I leave the timestamp in the partial document, the existing document is updated, including the timestamp.

When I remove the timestamp from the partial document, the existing document is not updated at all. There are also no errors in the log files.

What could be the reason why the existing document is not updated after removing the timestamp from the partial document?
How can I update an existing document using Logstash, without updating the timestamp?

2 Likes