In this post, we will see how to resolve Fetching the entire elasticsearch document into a logstash event

Question:

How can I store the entire document found via the elasticsearch filter into the current logstash event? As far as I can tell, I can only target fields to be copied over manually by using the “fields” attribute of the ES filter. Moreover, I cannot exactly use the ‘fields’ attribute because I am querying across multiple indexes that have different shapes which may change in the future.
Ideally, my logstash event will have a new attribute ‘results’ or something of the like that contains a list of the documents that matched the query.
I would essentially like to do something like this:
I’ve tried using wildcard matching for the source fields, to no avail.

Best Answer:

Tldr;

This is possible with the docinfo_fields that let you access the _<fields> of the query.

Solution

If you have better answer, please add a comment about this, thank you!

Source: Stackoverflow.com