I use this config to insert document in ES :```
output {
if [type] == "usage" {
elasticsearch {
hosts => ["elastic4:9204"]
index => "usage-%{+YYYY-MM}"
document_id => "%{IDSU}"
action => "update"
doc_as_upsert => true
}
}
This is fine but the problem i have the duplicates occur within the different month, when the month rolls over, and the document still appears, elastic/logstash thinks it's a new doc, and create new document bu i want to do is to update document wich dos'ent exist in current index but in the old index.
Is there a way to make the upsert work cross index? These would all be the same type of doc, they would simply apply change status field for exampl
But the indexs have the same structure juste , i create every month new index , what i want when i want add doc i must search in old index if the same doc with doc_id already exist if this case i update in the document in old index, else i creat one new document in the last index index (of current month) , i use upsert it work fine if this is the same index but i if not i have duplicate document
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.