From 39929882edf037edb7e1926c02f98a9bca06f901 Mon Sep 17 00:00:00 2001
From: Aleksandr Maus <aleksandr.maus@elastic.co>
Date: Mon, 23 Sep 2024 08:51:54 -0400
Subject: [PATCH] Fix system tests using logstash for ingest only write one
 event per data stream (#2117)

---
 internal/stack/_static/logstash.conf.tmpl | 30 ++++++++++++++++-------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/internal/stack/_static/logstash.conf.tmpl b/internal/stack/_static/logstash.conf.tmpl
index 27068b5de..ee90cd63f 100644
--- a/internal/stack/_static/logstash.conf.tmpl
+++ b/internal/stack/_static/logstash.conf.tmpl
@@ -21,14 +21,26 @@ filter {
 }
 
 output {
-  elasticsearch {
-    hosts => ["{{ $elasticsearch_host }}"]
-    user => '{{ fact "username" }}'
-    password => '{{ fact "password" }}'
-    ssl_enabled => true
-{{- if eq $elasticsearch_host "https://elasticsearch:9200" }}
-    ssl_certificate_authorities => "/usr/share/logstash/config/certs/ca-cert.pem"
-    document_id => "%{[@metadata][_ingest_document][id]}"
-{{- end }}
+  if [@metadata][_ingest_document][id] {
+    elasticsearch {
+      hosts => ["{{ $elasticsearch_host }}"]
+      user => '{{ fact "username" }}'
+      password => '{{ fact "password" }}'
+      ssl_enabled => true
+  {{- if eq $elasticsearch_host "https://elasticsearch:9200" }}
+      ssl_certificate_authorities => "/usr/share/logstash/config/certs/ca-cert.pem"
+      document_id => "%{[@metadata][_ingest_document][id]}"
+  {{- end }}
+    }
+  } else {
+    elasticsearch {
+      hosts => ["{{ $elasticsearch_host }}"]
+      user => '{{ fact "username" }}'
+      password => '{{ fact "password" }}'
+      ssl_enabled => true
+  {{- if eq $elasticsearch_host "https://elasticsearch:9200" }}
+      ssl_certificate_authorities => "/usr/share/logstash/config/certs/ca-cert.pem"
+  {{- end }}
+    }
   }
 }