Enrich-existing-elasticsearch-index-with-new-fields-from-logstash

You can use the update API [1]
This talk [2] gives examples on using scroll and update APIs to efficiently update positions as new log records arrive.

[1] https://www.elastic.co/guide/en/elasticsearch/reference/5.1/docs-update.html
[2] https://www.youtube.com/watch?v=yBf7oeJKH2Y