14

I'm having trouble with ElasticSearch, how can I change id to another field in log file ?

katy
  • 181
  • 1
  • 3
  • 13
  • 1
    Welcome to SO. Please elaborate a bit on your problem so we can help you the best we can. Show us your mapping, a sample document, how you ids look like and how you'd like to change them. Anything that can help us understand what you're facing. – Val May 22 '15 at 08:35
  • 1
    @katy why the bounty if there is an accepted answer? – Andrei Stefan Feb 20 '18 at 17:02

1 Answers1

22

In the elasticsearch output you can set the document_id for the event you are shipping. This will end up being the _id in elasticsearch. You can use all sort of parameters / field references / ... that are available in logstash config. Like so:

elasticsearch { 
    host => yourEsHost
    cluster => "yourCluster"
    index => "logstash-%{+YYYY.MM.dd}"
    document_id => "%{someFieldOfMyEvent}"
}

In this example someFieldOfMyEvent ends up being the _id of this event in ES.

markus
  • 1,631
  • 2
  • 17
  • 31