logstash: apache access log example using fingerprint filter - how to create unified event ids that can be re-imported/updated into Elasticsearch

logstash_apache.conf

input {
  file {
    type => "apache"
    start_position => "beginning"
    #    path => ["/var/log/secure", "/var/log/messages"]
    path => ["/var/log/access.log.201*"]
    exclude => ["*.gz"]
  }
}

filter {
  fingerprint {
    "key"    => "0123"
    "method" => "SHA1"
  }
 
  if [type] == "apache" {
    grok {
      match => [ "message", "%{COMBINEDAPACHELOG} %{NUMBER:duration:int}" ]
      match => [ "message", "%{COMBINEDAPACHELOG}"  ]
      add_tag => [  "parsed" ]
      add_tag => [   "index" ]
    }

    mutate {
      convert => { 
           "response" => "integer" 
            "bytes" => "integer"  
      }
    }

    ruby {
        # convert Apache responsetime from usec into ms
        code => "event['duration'] = (event['duration'] / 1000) if event['duration']"
    }
    date {
      match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
      add_tag => [ "dated" ]
    }
  }
}

output {
  #  stdout { codec => rubydebug }
  
  # output grok failures into custom error log
  if "_grokparsefailure" in [tags] {
    stdout {  codec => rubydebug  }
    file {
      message_format => "%{message}"
      path => "/tmp/logstash_grok_errors.log"
    }
  }

  # only output "index" events to  ES
  if "index" in [tags] {
   elasticsearch { document_id => "%{fingerprint}"  }
  }
}