# Logstash action "Update" **URL:** \ **Category:** Logstash\ **Created:** [June 26, 2018, 9:44am UTC](https://discuss.elastic.co/t/logstash-action-update/137406 "2018-06-26T09:44:18Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![safhw91](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@safhw91](https://discuss.elastic.co/u/safhw91)\ **Post date:** [June 26, 2018, 9:44am UTC](https://discuss.elastic.co/t/logstash-action-update/137406/1 "2018-06-26T09:44:18Z")
I have several huge files (hundreds of GBs) that I want to "double parse" with logstash. I have one file which maps user IDs to user emails, and then another huge file which maps user IDs to their actions. So in my first parse (which is very normal), I'll index the user ID and action. In the second parse, I'll make use of logstash's output `action => "update"` to update it with the email address. However, I'm not very clear of how Elastic is doing this updating. Does it delete (hide) the old data and make a new copy? If so, does the old data ever get deleted? Am I doing something completely wrong here? Thanks! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 26, 2018, 5:20pm UTC](https://discuss.elastic.co/t/logstash-action-update/137406/2 "2018-06-26T17:20:04Z")
> However, I'm not very clear of how Elastic is doing this updating. Does it delete (hide) the old data and make a new copy? Yes. So, avoid that. Maybe you can stuff the lookup tables in a database and use a jdbc\_static or jdbc\_streaming filter. > If so, does the old data ever get deleted? Yes, when the segment files are rewritten. I believe that's done when they become too many, but check the ES docs. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 24, 2018, 5:20pm UTC](https://discuss.elastic.co/t/logstash-action-update/137406/3 "2018-07-24T17:20:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.