Coming from classic SQL and NoSql databases, I thought it must be possible to change documents in Elasticsearch datastream indexes. The first attempt via update_by_query (REST-Api) worked in the test but not in productive operation (relatively high change rate. > 10 changes / sec). The next attempt to control the requests via a MessageBroker and a queue with prefetch=1 (only one request at a time) worked better, but also failed with high transaction rates. The attempt to delete the existing document (delete_by_query) and to create a new one in the changed version worked better again, but not without problems.
It seems to me that it is impossible to reliably change documents in Elasticsearch Datastreams.
Translated with www.DeepL.com/Translator (free version)