CODEWITHSUNDEEP
elasticsearchlogstash
katy
katy

Reputation: 181

Change ID in elasticsearch

I'm having trouble with ElasticSearch, how can I change id to another field in log file ?

Upvotes: 14

Views: 5094

Answers (1)

markus
markus

Reputation: 1651

In the elasticsearch output you can set the document_id for the event you are shipping. This will end up being the _id in elasticsearch. You can use all sort of parameters / field references / ... that are available in logstash config. Like so:

elasticsearch { 
    host => yourEsHost
    cluster => "yourCluster"
    index => "logstash-%{+YYYY.MM.dd}"
    document_id => "%{someFieldOfMyEvent}"
}

In this example someFieldOfMyEvent ends up being the _id of this event in ES.

Upvotes: 22

Related Questions