Update elasticsearch document with logstash

Elastic Stack Logstash
1

I filled data in elasticsearch via a logstash run with jdbc input plugin:

input {
    jdbc {
		jdbc_connection_string => "jdbc:sqlserver://*.*.*.*;databaseName=DB_TEST;"
          jdbc_user => "user"
		  jdbc_password => "pass"
        jdbc_driver_library => "C:\Program Files (x86)\sqljdbc_6.0\enu\sqljdbc42.jar"
        jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
		statement => "	  SELECT id, random_characters,  date_of_insert FROM POC_TEST_LOGSTASH"
    }
}

output {
           elasticsearch { 
		   hosts => "localhost:9200"
		   index => "test_index"
		   document_type => "test_type"	
		   document_id => "%{id}"
		}
}

It worked , I display thoses documents in elasticsearch:

GET test_index/_search
 "hits": [
      {
        "_index": "test_index",
        "_type": "test_type",
        "_id": "14",
        "_score": 1,
        "_source": {
          "@timestamp": "2017-03-27T09:02:40.844Z",
          "random_characters": "CUVANYCPBFBNUYH",
          "date_of_insert": "2017-03-22 19:06:01 +0100",
          "@version": "1",
          "id": 14
        }
      },
      {
        "_index": "test_index",
        "_type": "test_type",
        "_id": "19",
        "_score": 1,
        "_source": {
          "@timestamp": "2017-03-27T09:02:40.850Z",
          "random_characters": "EXNEGLBDVXQCFAH",
          "date_of_insert": "2017-03-22 19:26:05 +0100",
          "@version": "1",
          "id": 19
        }
      },
      ....

Now I want to update a doc :
I wrote:

input {
    jdbc {
		jdbc_connection_string => "jdbc:sqlserver://*.*.*.*;databaseName=DB_TEST ;"
          jdbc_user => "user"
		  jdbc_password => "pass"
        jdbc_driver_library => "C:\Program Files (x86)\sqljdbc_6.0\enu\sqljdbc42.jar"
        jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
		statement => "	SELECT id, random_characters,  date_of_insert FROM DB_TEST WHERE id = 1"
    }
}

output {
           elasticsearch { 
			   hosts => "localhost:9200"	  
			   action => "update"
			   index => "test_index"
			   document_type => "test_type"	
			   document_id => "%{id}"
		}
}

It updates nothing and display in output:

11:35:17.047 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - New Elasticsearch output {:class=>"LogStash::Outputs::Elasticsearch", :hosts=>[#<URI::Generic:0x78fba61d URL://localhost:9200>]}
11:35:17.052 [[main]-pipeline-manager] INFO logstash.pipeline - Starting pipeline {"id"=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>1000}
11:35:17.833 [[main]-pipeline-manager] INFO logstash.pipeline - Pipeline main started
11:35:17.920 [[main]<jdbc] INFO logstash.inputs.jdbc - (0.057000s) SELECT * FROM DB_TEST WHERE id = 1
11:35:17.984 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=>9600}
11:35:20.849 [LogStash::Runner] WARN logstash.agent - stopping pipeline {:id=>"main"}

what is weird is that the document i want to update seems to be found but i least it appears to remain unchanged
Do you have idea what I did wrong?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.