in lib/logstash/outputs/opensearch.rb [305:333]
def event_action_tuple(event)
params = common_event_params(event)
params[:_type] = get_event_type(event) if use_event_type?(nil)
if @parent
if @join_field
join_value = event.get(@join_field)
parent_value = event.sprintf(@parent)
event.set(@join_field, { "name" => join_value, "parent" => parent_value })
params[routing_field_name] = event.sprintf(@parent)
else
params[:parent] = event.sprintf(@parent)
end
end
action = event.sprintf(@action || 'index')
if action == 'update'
params[:_upsert] = LogStash::Json.load(event.sprintf(@upsert)) if @upsert != ""
params[:_script] = event.sprintf(@script) if @script != ""
params[retry_on_conflict_action_name] = @retry_on_conflict
end
params[:version] = event.sprintf(@version) if @version
params[:version_type] = event.sprintf(@version_type) if @version_type
EventActionTuple.new(action, params, event)
end