# Update existing document
**URL:** https://discuss.elastic.co/t/update-existing-document/304581
**Category:** Logstash
**Created:** [May 12, 2022, 1:36pm UTC](https://discuss.elastic.co/t/update-existing-document/304581 "2022-05-12T13:36:24Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ChinigamiHunter](https://discuss.elastic.co/u/ChinigamiHunter)
#### Post date: [May 12, 2022, 1:36pm UTC](https://discuss.elastic.co/t/update-existing-document/304581/1 "2022-05-12T13:36:24Z")
I am facing the following issue with Elasticsearch and logstash.
every day logstash create index with current date like : mydata\_2022.05.12
i have a index patterns name: mydata\_\*
i get documents from api and index them using logstash so if a document is indexed 2022.05.11
and updated in 2022.05.12 it will be duplicate.
there is any way to update or delete the first one automatically.
I'm pretty new to logstash, so any help is much appreciated :).
Here is my logstash conf.
```auto
input {
file {
path => "/etc/logstash/conf.d/documents/*.json"
mode => "read"
start_position => "beginning"
sincedb_path => "NUL"
codec => multiline {
negate => true
what => "previous"
pattern => '^\{'
max_lines => 10000000
}
type => "json"
file_completed_action => "log_and_delete"
file_completed_log_path => "/etc/logstash/conf.d/documents/files.log"
}
}
filter {
json {
source => message
}
}
output {
stdout {
codec => rubydebug {
metadata => false
}
}
elasticsearch {
hosts => ["http://localhost:9200"]
index => "mydata_%{+yyyy.MM.dd}"
document_id => "%{[data][uuid]}"
}
}
```
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [May 12, 2022, 3:20pm UTC](https://discuss.elastic.co/t/update-existing-document/304581/2 "2022-05-12T15:20:56Z")
> [@ChinigamiHunter](#):
>
> `sincedb_path => "NUL"`
1. When you set to null, this means LS will lose file list which had been read.
sincedb\_path =\> "/dev/null" - Linux
You can also try to use _json\_lines_ codec for multiline JSON files.
2. Duplication. Your source must have unique value to recognize update.
ES logic is quite good, unique document\_id does not exist -\> insert; unique document\_id does exist -\> update. Usually, for doc\_id is used temporary field @metadata.
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
index =\> "mydata\_%{+yyyy.MM.dd}"
document\_id =\> "%{[@metadata][uuid]}"
}
If you have fields: document\_id =\> "%{[@metadata][uuid]}"
uuid field1 field2 field3:
1 a b c -\> insert
3 e d f -\> insert
1 x y z -\> update
If you don't have a unique value per line, you might try to use fingerprint plugin:
```auto
fingerprint {
source => ["user_id", "siblings", "birthday"]
}
```
---
### Author:  [@ChinigamiHunter](https://discuss.elastic.co/u/ChinigamiHunter)
#### Post date: [May 12, 2022, 4:24pm UTC](https://discuss.elastic.co/t/update-existing-document/304581/3 "2022-05-12T16:24:01Z")
Got it, Thank you @Rios
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 9, 2022, 4:24pm UTC](https://discuss.elastic.co/t/update-existing-document/304581/4 "2022-06-09T16:24:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.