I was only able to have a similar feature as what you wanted by creating explicit created_at and updated_at fields:
input { stdin { codec => json } }
filter {
ruby {
code => "event.set('updated_date', event.get('@timestamp'))"
}
}
output {
elasticsearch {
action => update
document_id => "%{my_id}"
upsert => '{ "document_id": "%{my_id}", "value": "%{value}", "created_at": "%{@timestamp}", "updated_at": "%{@timestamp}" }'
}
}