Update/delete existing log entry with logstash

Question

Is there a way to tell logstash to remove/update some log entries from Elasticsearch? It seems that Logstash can index documents but I didn't find evidence that it can make update/delete operations.

If it is possible, we could imagine that we could "log" operations on Elasticsearch and use Logstash to output them in bulk in Elasticsearch. This way the programmer doesn't have to create a mechanism to make bulk operations on Elasticsearch.

Answer 1

Everything is in the docs.

To update an entry with Logstash, you need to provide the document id in document_id and the document will be replaced with the new content.

To delete a document with logstash, provide it's id in document_id and set the action field to "delete".