Add stop timestamp base on previous doc (event)

[moimart1 (Martin)]

Hello,

I push some events to elasticsearch with the following structure:

{
    "name": "status",
    "value": "active",
    "timestamp": "2018-01-01T00:00:00.000Z"
}

And when I receive a new event with the same name, like

{
    "name": "status",
    "value": "stopped",
    "timestamp": "2018-01-01T01:00:00.000Z"
}

I want to update the event status:active with a stopTimestamp field, like

{
    "name": "status",
    "value": "active",
    "timestamp": "2018-01-01T00:00:00.000Z"
    "stopTimestamp": "2018-01-01T01:00:00.000Z"
}

The final goal is to show events / transactions on a timeline, and the timeline require the field stop date

It is possible to have a document with a start and a stop date base on two previous events ?

Thanks

Martin

[Mark_Harwood]

@moimart1

And when I receive a new event with the same name , like

If you have lots of unique names to track see discussion on Distinct count with filter

[moimart1 (Martin)]

Thanks

If I understand correctly, you suggest to do another index with my events with start stop from my events with only start.

How I can update automatically my new index ? I need to do an external script or I can have a "built-in" solution ?