# Updating only a single field of an elasticsearch data through logstash

**URL:** https://discuss.elastic.co/t/updating-only-a-single-field-of-an-elasticsearch-data-through-logstash/306540
**Category:** Logstash
**Tags:** painless
**Created:** [June 7, 2022, 8:37am UTC](https://discuss.elastic.co/t/updating-only-a-single-field-of-an-elasticsearch-data-through-logstash/306540 "2022-06-07T08:37:48Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![dishant.sharma](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)
#### Post date: [June 7, 2022, 8:37am UTC](https://discuss.elastic.co/t/updating-only-a-single-field-of-an-elasticsearch-data-through-logstash/306540/1 "2022-06-07T08:37:48Z")

</div>

I have a logstash pipeline put into place through which I am getting logs. I want to handle a use-case through logstash configuration in which I have to append a particular value to a field. Currently, it is happening that instead of appending the value at the end of the present value in the index, it replaces the entire value inside the field with the value to be appended.

I want the value to be appended to behave exactly as intended and should get appended to the end.

My Logstash.conf file looks like this:

```auto
input {
    kafka {
        bootstrap_servers => "http://kafka:9092"
        topics => "elasticIndexUpdateTopic"
        codec => json {}
    }
}

filter {
    mutate {
        remove_field => ["@timestamp", "@version"]
    }
}

output {
    if ([isAppend] or [isAppend] == "true") {
    elasticsearch {
      hosts => ["http://elasticsearch:9200"]
      index => "su-test"
      document_id => "%{[id]}"
      action => "update"
      doc_as_upsert => true 
      script_lang => "painless"
      script => "for(item in params.event.get('%{[field]}')){if(!ctx._source.%{[field]}.contains(item)){ctx._source.%{[field]}.add(item)}}"
      }
    }
    else {
      elasticsearch {
        hosts => ["http://elasticsearch:9200"]
        index => "su-test"
        document_id => "%{[id]}"
        action => "update"
        doc_as_upsert => true 
      }
  }
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2022, 8:38am UTC](https://discuss.elastic.co/t/updating-only-a-single-field-of-an-elasticsearch-data-through-logstash/306540/2 "2022-07-05T08:38:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.