# Upsert function in Logstash not working

**URL:** <https://discuss.elastic.co/t/upsert-function-in-logstash-not-working/173938>\
**Category:** Logstash\
**Created:** [March 26, 2019, 1:23pm UTC](https://discuss.elastic.co/t/upsert-function-in-logstash-not-working/173938 "2019-03-26T13:23:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![shruti51](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@shruti51](https://discuss.elastic.co/u/shruti51)\
**Post date:** [March 26, 2019, 1:23pm UTC](https://discuss.elastic.co/t/upsert-function-in-logstash-not-working/173938/1 "2019-03-26T13:23:50Z")

</div>

HI,

I am trying to use upsert function to update value of column in an index.  
My column is not getting updated.It shows only sagstatus = SAGReceived.

> > input {  
> > beats {  
> > port =\> 5044  
> > }  
> > }

# The filter part of this file is commented out to indicate that it is

# optional.

> ```
> > filter { 
> > if [fields][log_type] == "ABC" {
> > if "MNO" in [message] {
> > dissect {
> > mapping => { 
> > message => "%{date} ##%{HostName}##%{ABC}##%{SourceMessage}" }
> > }
> > xml {
> > source => "SourceMessage"
> > store_xml => false
> > xpath => ["/a/b/text()", "msg_type"]
> > 						
> > } 	
> > mutate { 
> > add_field => { "SAGstatus" => "SAGReceived" }
> > add_field => { "STO_Number" => "%{HostName}" }
> > remove_field => ["SourceMessage","Filler1","Filler2","Filler3","Filler4","Filler5","Filler6","Filler7","ServiceContextId"]
> > }
> > }
> > 
> > if "def" in [message] {
> > dissect {
> > mapping => { 
> > message => "%{Timestamp} ##%{HostName}##%{def}" }
> > }
> > mutate { 
> > remove_field => ["Filler1","Filler2","Filler3","Filler4","Filler5","Filler6","Filler7","ServiceContextId"]
> > add_field => { "SAGstatus" => "SAGProcessed" }
> > add_field => { "STO_Number" => "%{HostName}" }
> > }		
> > }
> 
> ```

```
output {
 elasticsearch 
		{
		hosts => "localhost:9200"
		manage_template => false
		index => "manage-%{+YYYY.MM.dd}" 
		action => "update"
		document_id => "%{STO_Number}"
		doc_as_upsert => true
		}
 stdout { codec => rubydebug }
}

```

When SAGProcessed log is run for same STO\_Number , SAG\_status is not getting updated to SAG\_processed.  
Please help if you see any discrepancy in logstash or any other probable cause of not updating.

---

<div class="post-metadata">

**Author:** ![Varun\_Mahajan](https://avatars.discourse-cdn.com/v4/letter/v/a88e4f/32.png) [@Varun\_Mahajan](https://discuss.elastic.co/u/Varun_Mahajan)\
**Post date:** [March 29, 2019, 8:55am UTC](https://discuss.elastic.co/t/upsert-function-in-logstash-not-working/173938/2 "2019-03-29T08:55:19Z")

</div>

I am facing the similar issue

---

<div class="post-metadata">

**Author:** ![shruti51](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@shruti51](https://discuss.elastic.co/u/shruti51)\
**Post date:** [April 5, 2019, 9:34am UTC](https://discuss.elastic.co/t/upsert-function-in-logstash-not-working/173938/3 "2019-04-05T09:34:56Z")

</div>

Hey Varun,

Did you get any leads on it.

---

<div class="post-metadata">

**Author:** ![Varun\_Mahajan](https://avatars.discourse-cdn.com/v4/letter/v/a88e4f/32.png) [@Varun\_Mahajan](https://discuss.elastic.co/u/Varun_Mahajan)\
**Post date:** [April 5, 2019, 9:46am UTC](https://discuss.elastic.co/t/upsert-function-in-logstash-not-working/173938/4 "2019-04-05T09:46:51Z")

</div>

no updates on this . sorry

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 3, 2019, 9:46am UTC](https://discuss.elastic.co/t/upsert-function-in-logstash-not-working/173938/5 "2019-05-03T09:46:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.