# Update by Query in Logstash
**URL:** https://discuss.elastic.co/t/update-by-query-in-logstash/153653
**Category:** Logstash
**Created:** [October 23, 2018, 4:56pm UTC](https://discuss.elastic.co/t/update-by-query-in-logstash/153653 "2018-10-23T16:56:13Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Andrew\_Stroz](https://discuss.elastic.co/u/Andrew_Stroz)
#### Post date: [October 23, 2018, 4:56pm UTC](https://discuss.elastic.co/t/update-by-query-in-logstash/153653/1 "2018-10-23T16:56:13Z")
I am ingesting documents continually into elastic and one of my main search queries is getting the most recent document in a series. I am currently doing this using a top\_hits aggregation and then sorting the results with the same internal document id field (separate from '\_id', lets call this 'doc\_id'). I would like to move away from using the aggregations as it used quite a bit of RAM so I want to create a field in the document called 'current' and set it to true if it is the most recent and set it to false if not.
I was hoping that there would be a plugin for logstash that could query elastic for the 'doc\_id' field and update the 'current' field in that document to false, but I discovered this was not possible. Am I looking at this the wrong way or is there something that will let me do this?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 20, 2018, 4:56pm UTC](https://discuss.elastic.co/t/update-by-query-in-logstash/153653/2 "2018-11-20T16:56:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.