Change ID in elasticsearch

Question

I\'m having trouble with ElasticSearch, how can I change id to another field in log file ?

Answer 1

In the elasticsearch output you can set the document_id for the event you are shipping. This will end up being the _id in elasticsearch. You can use all sort of parameters / field references / ... that are available in logstash config. Like so:

elasticsearch { 
    host => yourEsHost
    cluster => "yourCluster"
    index => "logstash-%{+YYYY.MM.dd}"
    document_id => "%{someFieldOfMyEvent}"
} 

In this example someFieldOfMyEvent ends up being the _id of this event in ES.