in order to put document in elasticsearch, I actually use Filebeat and Logstash : Filebeat read logs and put then to logstash which reformats and puts data to Elasticsearch.
Actually I use the logstash options "action" and "doc_as_upsert" to permit document update :
action => "update"
doc_as_upsert => true
I want to stop use logstash. Is there a solution to make document update without logstash (in Filebeat or Elasticsearch) ?