Hello @Jason_Paralta ,
I have come to my conclusion that this can't be better managed,may be I am wrong, after reading various blogs and post in community I understood that If you've frequent updates in your data then rollover is not best solution, as this causes duplicates.
If I use single index only this resolves all issue but the very need of ILM automatically managing my indices vanishes.
I'm still working on this, if found something worthwhile solution will post here.
Alternatively I'm following this post in stack overflow, unable to understand the filter that james jiang mentioned here, how he has implemented this and if possible then to search in document in previous rollover is big task for logstash processing.
Conclusion: Use only single index resolve duplicates, if ILM used here then entire data will be lost as single index and in case you require historical data-its lost.
How to better send the data is the question here,For timeserires data its not issue and only for frequent data updates with rollover this don't work well.