On ES 6.2 and Logstash 6.1, currently I'm using doc_as_upsert with a document id defined by incoming fields. This is to allow updates. However I would also like to maintain a 'created at' date which will be set the first time a document is created. Is there a way in the logstash elasticsearch output to specify a field to exclude from the upsert in order to ensure it is not overwritten?
Cheers.