In this post, we will see how to resolve Fetching the entire elasticsearch document into a logstash event
Question:How can I store the entire document found via the elasticsearch filter into the current logstash event? As far as I can tell, I can only target fields to be copied over manually by using the “fields” attribute of the ES filter. Moreover, I cannot exactly use the ‘fields’ attribute because I am querying across multiple indexes that have different shapes which may change in the future.
Ideally, my logstash event will have a new attribute ‘results’ or something of the like that contains a list of the documents that matched the query.
I would essentially like to do something like this:
This is possible with the
docinfo_fieldsthat let you access the
_<fields>of the query.
If you have better answer, please add a comment about this, thank you!