将文件添加到elasticsearch(如果不存在) [英] Add documents to elasticsearch if it does not exists

问题描述

我使用logstash将每天生成的日志中的一些数据传输到elasticsearch，我的logstash输出部分如下所示:

I transferred some data from a log generated every day to elasticsearch using logstash, and my logstash output section looks like :

我在我的日志文件和elasticsearch中都保留了相同的ID(id_ot)，但是我想做的是:如果Elasticseach中已经存在新的ID(id_ot)，那么我将不插入它.我该如何在logstash中做到这一点?

i keep the same id (id_ot) in both my log file and elasticsearch, but what i would like to do is : if the new coming id ( id_ot) already exists in elasticseach, so i will not insert it. How can i do that in logstash ?

任何帮助都会得到真正的帮助！

Any help would be really appriciated !

推荐答案

您只需要添加

You simply need to add the action => create parameter and if a document already exists with that ID, it is not indexed

output {
  elasticsearch {
    ...
    action => "create"
  }
}

这篇关于将文件添加到elasticsearch(如果不存在)的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！