# ConditionalUpdate **URL:** \ **Category:** Logstash\ **Created:** [May 26, 2016, 9:28am UTC](https://discuss.elastic.co/t/conditionalupdate/51037 "2016-05-26T09:28:21Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Laurens\_Raven](https://avatars.discourse-cdn.com/v4/letter/l/47e85d/32.png) [@Laurens\_Raven](https://discuss.elastic.co/u/Laurens_Raven)\ **Post date:** [May 26, 2016, 9:28am UTC](https://discuss.elastic.co/t/conditionalupdate/51037/1 "2016-05-26T09:28:21Z")
Dear Logstash/ElasticSearch, With logstash I'm reading an event file. Each event has a timestamp with it, and several events are relating to one document in elastic search. Typically events are 1° "started" , 2° "doing somethign" , 3° "failed" of "delivered" The issue is that the events will not necessary come in the correct order and I need to ensure that the event I send to Elastic seach is newer then the last one I sent. I added a field 'LastEventTimestamp" in ElasticSearch for each document so should be easy enough.( or so I thought) However I can't seem to get the combination **in one logstach configuration**. 1° reading from event file 2° lookup in elastic search for Document and taking the latest LastEventTimestamp 3° updating Document if date is ok The lookup part is eluding me. Any help welcome ! Kind regards Laurens ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 27, 2016, 12:46am UTC](https://discuss.elastic.co/t/conditionalupdate/51037/2 "2016-05-27T00:46:11Z")
What do you have in so far then? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:55am UTC](https://discuss.elastic.co/t/conditionalupdate/51037/3 "2017-07-06T04:55:56Z")