# Update nested array in existing document

**URL:** <https://discuss.elastic.co/t/update-nested-array-in-existing-document/283957>\
**Category:** Logstash\
**Created:** [September 11, 2021, 8:08pm UTC](https://discuss.elastic.co/t/update-nested-array-in-existing-document/283957 "2021-09-11T20:08:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![zeoiioze](https://avatars.discourse-cdn.com/v4/letter/z/d07c76/32.png) [@zeoiioze](https://discuss.elastic.co/u/zeoiioze)\
**Post date:** [September 11, 2021, 8:08pm UTC](https://discuss.elastic.co/t/update-nested-array-in-existing-document/283957/1 "2021-09-11T20:08:01Z")

</div>

Hello !  
I have documents with fields like that :

- `doc.site` containing a string like `"paris"`
- `doc.ips.values` containing a list of strings `["10.0.0.1", "10.0.0.2"]`, or which can sometimes be empty `[]`
- `doc.ips.last_checked` containing a date like `"2021-08-17T19:34:51.000Z"`

And I want to create a new event (document) in Elasticsearch if a document with `doc.site` doesn't already exists.  
If a document with the same `doc.site` value exist, I want to update some fields.

For example, lets image i receive this new document in logstash :

- `doc.site` = `"paris"`

- `doc.ips.values` = ["10.0.0.3"]

- `doc.ips.last_checked` = `"2021-08-18T19:34:51.000Z"`

- Then I want to update `doc.ips.values` and only add the values that didn't already exists inside (i.e. I only want to add the value `"10.0.0.3"` to the array. Then, the array withh contain `["10.0.0.1", "10.0.0.2", "10.0.0.3"]`

- I also want to replace the content of `doc.ips.last_checked` with the value received in the most recend document.

Here is my config which is not working :

```auto
elasticsearch {
      hosts => ["localhost:9200"]
      index => "myindex"
      action => "update"
      document_id => "%{[doc][site]}"
      doc_as_upsert => "true"
      script => 'ctx._source.doc.ips.values.add("%{[doc][ips][values]}");'
    }

```

As you can see on the image below, it's not working at all as expected.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/e/4e862c1c54236e7eb55a941569f1450890ee61ff.png)

Furthermore, when I send a document with a value like `doc.ips.values` = `[]`, it's adding `(empty)` to my array...

Could someone help me ? Thanks a lot in advance !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 9, 2021, 8:08pm UTC](https://discuss.elastic.co/t/update-nested-array-in-existing-document/283957/2 "2021-10-09T20:08:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.