Logstash update nested data - logstash

Question

I'm having a nested field as below
"appdata": {
"type":"nested",
"include_in_parent":true,
"properties": {
"accessType": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"appname": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"eventtime": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
I'm updating the same using logstash in output plugin as below
elasticsearch
{
hosts => ["localhost:9200"]
document_id => "%{sid}"
index => "dashboard_write"
timeout => 30
script => "if (ctx._source.appdata == null) { ctx._source.appdata = params.event.get('appdata') } else { ctx._source.appdata = ctx._source.appdata + params.event.get('appdata') }"
doc_as_upsert => true
action => "update"
}
First time appdata will be null and it should assign that value. For second event, it should append the data to existing appdata
But I saw ctx._source.appdata is empty even though data is there
Am I doing anything wrong here

Answer 1

I'm having input as syslog and filter as below
filter{
if [I]=="525"
{
useragent
{
source => "T"
}
kv
{
source => "S"
field_split => ","
value_split => "="
}
mutate
{
split => ["Y", " "]
split => ["B", "-"]
split => ["T", "?"]
add_field => { "sessionid" => "%{[T][0]}" }
add_field => { "appdata" => null }
}
}
if [I]=="514"
{
mutate
{
split => ["T", "?"]
rename => { "I" => "eventid" }
add_field => { "sid" => "%{[T][0]}" }
add_field => { "[appdata][accessType]" => "app1" }
add_field => { "[appdata][appname]" => "%{F}" }
add_field => { "[appdata][eventtime]" => "%{timestamp}" }
}
}
}
Output looks like below
if[I]=="525"
{
elasticsearch
{
hosts => ["localhost:9200"]
document_id => "%{sessionid}"
index => "dashboard_write"
}
stdout { codec => rubydebug }
}
else if[I]=="514"
{
elasticsearch
{
hosts => ["localhost:9200"]
document_id => "%{sid}"
index => "dashboard_write"
timeout => 30
script => "if (ctx._source.appdata == null) { ctx._source.appdata =
params.event.get('appdata') } else { ctx._source.appdata =
ctx._source.appdata + params.event.get('appdata') }"
doc_as_upsert => true
action => "update"
}
}
First 525 event will come. It will be stored with a sessionid and appdata as null. Next event 514 will come with same session id. I'm suppose to update existing 525 record with 514 appdata. Subsequently if multiple 514 events come, just append that to nested object for same session id