# Conditional updating of existing record **URL:** \ **Category:** Logstash\ **Created:** [November 27, 2018, 9:55am UTC](https://discuss.elastic.co/t/conditional-updating-of-existing-record/158309 "2018-11-27T09:55:15Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Evelina\_V](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evelina_v/32/37935_2.png) [@Evelina\_V](https://discuss.elastic.co/u/Evelina_V)\ **Post date:** [November 27, 2018, 9:55am UTC](https://discuss.elastic.co/t/conditional-updating-of-existing-record/158309/1 "2018-11-27T09:55:15Z")
Hi, I am very new to elastic and would like to get an advice. I have messages looking something like that: THREAD\_ID:101 MSG\_TYPE:1 FINAL\_STATE:EXPIRED THREAD\_ID:101 MSG\_TYPE:2 FINAL\_STATE:DELIVERED They arrive in an uncontrolled manner: -sometimes MSG\_TYPE:1 comes first, -sometimes MSG\_TYPE:2 comes first, -sometimes only one of them arrive, -they never arrive from the same file. I need to write such logstash config that only MSG\_TYPE:1 info would be updated and I need to add additional field indicating which came first. For example if MSG\_TYPE:2 came second it should look like that: THREAD\_ID:101 MSG\_TYPE:2 FINAL\_STATE:DELIVERED RECEIVED:1,2 And if it arrived first: THREAD\_ID:101 MSG\_TYPE:2 FINAL\_STATE:DELIVERED RECEIVED:2,1 The solution I'm looking for should work in real time. Could you please advise me on what filters or methods to use in this case? ---
**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\ **Post date:** [November 27, 2018, 10:29am UTC](https://discuss.elastic.co/t/conditional-updating-of-existing-record/158309/2 "2018-11-27T10:29:32Z")
I think you could do this with the "update" action on the Elasticsearch output. You would need to set the DOC\_ID. I assume your thread\_id field is unique? ---
**Author:** ![Evelina\_V](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evelina_v/32/37935_2.png) [@Evelina\_V](https://discuss.elastic.co/u/Evelina_V)\ **Post date:** [November 27, 2018, 10:54am UTC](https://discuss.elastic.co/t/conditional-updating-of-existing-record/158309/3 "2018-11-27T10:54:57Z")
Yes it is unique and I do know how to set DOC\_ID. But with the update action message is updated by whichever comes last, isn't it? So in this case it works only if messages comes: THREAD\_ID:101 MSG\_TYPE:1 FINAL\_STATE:EXPIRED THREAD\_ID:101 MSG\_TYPE:2 FINAL\_STATE:DELIVERED Then I do get what I initially want: THREAD\_ID:101 MSG\_TYPE:2 FINAL\_STATE:DELIVERED But if MSG\_TYPE:2 would come first and MSG\_TYPE:1 later, my message would look like: THREAD\_ID:101 MSG\_TYPE:1 FINAL\_STATE:EXPIRED And I always need to keep the MSG\_TYPE:2 information. ---
**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\ **Post date:** [November 27, 2018, 11:09am UTC](https://discuss.elastic.co/t/conditional-updating-of-existing-record/158309/4 "2018-11-27T11:09:37Z")
Could you do a conditional output based on the message type field? ---
**Author:** ![Evelina\_V](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evelina_v/32/37935_2.png) [@Evelina\_V](https://discuss.elastic.co/u/Evelina_V)\ **Post date:** [November 27, 2018, 12:08pm UTC](https://discuss.elastic.co/t/conditional-updating-of-existing-record/158309/5 "2018-11-27T12:08:50Z")
Sorry I am not sure what you mean. Could you write a rough example of how conditional output should look in this case? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 25, 2018, 12:08pm UTC](https://discuss.elastic.co/t/conditional-updating-of-existing-record/158309/6 "2018-12-25T12:08:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.