3

Is it possible to access event fields in script of elasticsearch logstash output with scripted_upsert?

output {
    elasticsearch {
        hosts => ["elasticsearch:9200"]
        index => "index"
        document_type => "doctype"
        action => "update"
        document_id => "%{some_field}"
        scripted_upsert => true
        script => 'ctx._source.name = event["some_field"];'
        script_var_name => "event"
        script_type => "inline"
    }
}

If I use such script it does not upsert document. But if I set ctx._source.name to something static. For example.

script => 'ctx._source.name = "something"'

It works as expected. And upserts document.

LosBlancoo
  • 113
  • 10

1 Answers1

1

You can try this:

ctx._source.name = params.event.get("some_field")
Bruno Donath
  • 103
  • 3