# Can a particular record in index be updated by logstash conf file? **URL:** \ **Category:** Logstash\ **Created:** [September 7, 2016, 12:46pm UTC](https://discuss.elastic.co/t/can-a-particular-record-in-index-be-updated-by-logstash-conf-file/59979 "2016-09-07T12:46:48Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Varun\_Breja](https://avatars.discourse-cdn.com/v4/letter/v/9e8a1a/32.png) [@Varun\_Breja](https://discuss.elastic.co/u/Varun_Breja)\ **Post date:** [September 7, 2016, 12:46pm UTC](https://discuss.elastic.co/t/can-a-particular-record-in-index-be-updated-by-logstash-conf-file/59979/1 "2016-09-07T12:46:48Z")
We have a scenario like this: Server Error Count\_of\_Error D1 ER1 15 D1 ER2 15 Questions: 1. Can this count be updated in Index in logstash configuration file? 2. Will this maintain atomicity in case this index is getting updated by multiple filebeats 3. How index is stored inside ElasticSerach. Is this stored in files? Presently we are getting this count from kibana visualisation. We want to maintain the same in conf file. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 8, 2016, 8:04am UTC](https://discuss.elastic.co/t/can-a-particular-record-in-index-be-updated-by-logstash-conf-file/59979/2 "2016-09-08T08:04:56Z")
> Can this count be updated in Index in logstash configuration file? That's probably going to be hard. Where do these numbers come from? How are they getting into Logstash? > How index is stored inside ElasticSerach. Is this stored in files? Elasticsearch uses a file system for persistence, yes. ---
**Author:** ![Varun\_Breja](https://avatars.discourse-cdn.com/v4/letter/v/9e8a1a/32.png) [@Varun\_Breja](https://discuss.elastic.co/u/Varun_Breja)\ **Post date:** [September 8, 2016, 10:14am UTC](https://discuss.elastic.co/t/can-a-particular-record-in-index-be-updated-by-logstash-conf-file/59979/3 "2016-09-08T10:14:51Z")
> [@magnusbaeck](#): > > Can this count be updated in Index in logstash configuration file? magnusblack We need to create the count too in first place. The next time same error comes it should increment. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 8, 2016, 10:37am UTC](https://discuss.elastic.co/t/can-a-particular-record-in-index-be-updated-by-logstash-conf-file/59979/4 "2016-09-08T10:37:20Z")
Wouldn't it be easier to just use ES for this kind of counting? ---
**Author:** ![Varun\_Breja](https://avatars.discourse-cdn.com/v4/letter/v/9e8a1a/32.png) [@Varun\_Breja](https://discuss.elastic.co/u/Varun_Breja)\ **Post date:** [September 8, 2016, 11:15am UTC](https://discuss.elastic.co/t/can-a-particular-record-in-index-be-updated-by-logstash-conf-file/59979/5 "2016-09-08T11:15:34Z")
Yeah it would definitely be easier but we have a use case where we are going to purge data every 3-4 months. So we wanted to have a summary information of all the errors occured in the past which is count. We will be purging everything else except this count visualization as it will have only one row per error type. Can the same aggregation kibana does on UI can be performed on logstash level so that we don't need to store all records and we will be incrementing the same count whenever a same error occur ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:39am UTC](https://discuss.elastic.co/t/can-a-particular-record-in-index-be-updated-by-logstash-conf-file/59979/6 "2017-07-06T04:39:16Z")