# Conditional update to the document

**URL:** https://discuss.elastic.co/t/conditional-update-to-the-document/64964
**Category:** Elasticsearch
**Created:** [November 4, 2016, 2:06am UTC](https://discuss.elastic.co/t/conditional-update-to-the-document/64964 "2016-11-04T02:06:45Z")
**Posts on this page:** 1
**Showing post:** 16

<div class="post-metadata">

### Author: ![Dan\_Markhasin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dan_markhasin/32/14187_2.png) [@Dan\_Markhasin](https://discuss.elastic.co/u/Dan_Markhasin)
#### Post date: [June 3, 2017, 4:09pm UTC](https://discuss.elastic.co/t/conditional-update-to-the-document/64964/16 "2017-06-03T16:09:05Z")

</div>

It's something along the lines of the following:

```
filter {
  ruby {
    code => 'field_name = "update_script"
             condCol = event.get("condCol")
             arr = []
             script = "if (ctx._source.#{condCol} > params.event.get(\"#{condCol}\")) { ctx.op = \"none\" } else {<update>}"
             event.to_hash.each do |key,value|
              next if key.start_with?("@")
              arr.push("ctx._source.#{key} = params.event.get(\"#{key}\")")
             end
             updates = arr.join(";")
             script.sub!("<update>",updates)
             event.set(field_name,script)'
    }
}

```

And then in the elasticsearch output plugin:

`script => "%{update_script}"`

This assumes there is a "condCol" field in the input that describes which field should be used for the condition.  
Also, this assumes the data is flat (or that you don't care about nesting) - there is no deep merge going on here, top level values get fully overwritten.

---

_[View the full topic](https://discuss.elastic.co/t/conditional-update-to-the-document/64964)._