# Upsert not working for same index in Logstash output to ElasticSearch

**URL:** <https://discuss.elastic.co/t/upsert-not-working-for-same-index-in-logstash-output-to-elasticsearch/140559>\
**Category:** Logstash\
**Created:** [July 18, 2018, 1:00pm UTC](https://discuss.elastic.co/t/upsert-not-working-for-same-index-in-logstash-output-to-elasticsearch/140559 "2018-07-18T13:00:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![excellent.vivek](https://avatars.discourse-cdn.com/v4/letter/e/65b543/32.png) [@excellent.vivek](https://discuss.elastic.co/u/excellent.vivek)\
**Post date:** [July 18, 2018, 1:00pm UTC](https://discuss.elastic.co/t/upsert-not-working-for-same-index-in-logstash-output-to-elasticsearch/140559/1 "2018-07-18T13:00:27Z")

</div>

Hi,

I am using same index "index =\> "$logstash-%{+YYYY.MM.dd}"" for multiple configuration reading multiple logs so as to have one index for certain type of logs.

It only writes index in ElasticSearch for 1st configuration file which reads the logs and not for the other ones.

For example: I had an implementation with single configuration and index named "$logstash-%{+YYYY.MM.dd}"". Now I added another configuration to read other files and used same index "$logstash-%{+YYYY.MM.dd}"". In new configuration, filter generated more fields which didn't get updated in existing index of Elastic Search though it showed on stdout.

Output settings:

output {  
elasticsearch {  
hosts =\> ["ES01:9200"]  
index =\> "$logstash-%{+YYYY.MM.dd}"  
}  
}

I saw two options to use doc\_as\_upsert =\> "true" and document\_id field. I am not sure if document\_id should be same in both configurations. please help.

How to upsert new fields so as same index works for multiple configuration (fields generated from filter)?

---

<div class="post-metadata">

**Author:** ![excellent.vivek](https://avatars.discourse-cdn.com/v4/letter/e/65b543/32.png) [@excellent.vivek](https://discuss.elastic.co/u/excellent.vivek)\
**Post date:** [July 28, 2018, 9:59am UTC](https://discuss.elastic.co/t/upsert-not-working-for-same-index-in-logstash-output-to-elasticsearch/140559/2 "2018-07-28T09:59:44Z")

</div>

Hi, Root cause of issue has been identified.  
The Upsert worked fine with multiple such setups except the one config which had input filter having "_.log" for reading all files from one log folder. The same was adjusted as it was found other configs with unique input file name worked perfectly fine. To address this, I gave all names in input file instead of generic "c:/somedrive/_.log" and the same worked fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 25, 2018, 9:59am UTC](https://discuss.elastic.co/t/upsert-not-working-for-same-index-in-logstash-output-to-elasticsearch/140559/3 "2018-08-25T09:59:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.