I want to update an existing document in Elasticsearch based on certain conditions. However, I am facing some errors.
Here is my filter plugin configuration
filter
{
json { source => "message" }
if [baseValueUnitAmount] > 968
{
mutate
{
add_field => {"log" => "update"}
add_field => {"status" => "this is a updated log"}
}
elasticsearch {
hosts => ["es_host:9200"]
query => "myrefid:%{[myrefid]}"
fields => { "_id" => "doc_id" }
index => "replacement-test"
ssl => true
user => 'myuser'
password => 'mypassword'
}
}
}
output
{
stdout { codec => rubydebug }
if [log] == "update"
{
elasticsearch
{
codec => json
hosts => [ "es_host:9200" ]
action => "update"
document_id => "%{[doc_id]}"
index => "replacement-test"
ssl => true
ssl_certificate_verification => false
user => 'myuser'
password => 'mypassword'
}
}
else
{
elasticsearch
{
codec => json
hosts => [ "es_host:9200" ]
index => "replacement-test"
ssl => true
ssl_certificate_verification => false
user => 'myuser'
password => 'mypassword'
}
}
}
Here is the error I am getting :
[ERROR] 2021-06-03 00:29:25.847 [Converge PipelineAction::Create<main>] agent - Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}
Can anyone help ?
