Would it be possible to do something similar to this? Logstash - how to overwrite document instead of creating new ones
output {
elasticsearch {
host => 'your es host'
action => 'update'
document_id => "%{[globalCallID_callId]}"
index => 'your index name
}
}