# Update field based on values in multiple documents

**URL:** <https://discuss.elastic.co/t/update-field-based-on-values-in-multiple-documents/123601>\
**Category:** Logstash\
**Created:** [March 12, 2018, 5:26pm UTC](https://discuss.elastic.co/t/update-field-based-on-values-in-multiple-documents/123601 "2018-03-12T17:26:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)\
**Post date:** [March 12, 2018, 5:26pm UTC](https://discuss.elastic.co/t/update-field-based-on-values-in-multiple-documents/123601/1 "2018-03-12T17:26:45Z")

</div>

Hi  
I am sending logs/events to ES after parsing the log files though Logstash. Now what i want is to add a field after evaluating fields in multiple documents.

e.g following are the documents from the ES index.

pid=1, price=10, status=GD  
pid=2, price=5, status=GD  
..............................................  
..............................................  
..............................................  
pid=1, price=15, status=Shop  
pid=2, price=10, status=Shop  
pid=1, price=18, status=Customer  
..............................................

Now i want to check if price is greater than 10 for pid =1 and status=GD  
and if it the above is true then,  
I will check if price is greater than 11 for pid =1 and status=Shop  
and finally  
Check if price is greater than 15 for pid =1 and status=Customer

If the above evaluation is true for all the three cases, i want to add a field say result=true for all pid=1 so that final document looks like-

pid=2, price=5, status=GD, result=true

I did not find a way to do it through Logstash.

I think to do it i have to write a custom script that reads the ES index and checks for the conditions and add the field. If so how can i read the ES index though a separate script and add/update fields ?

Also is it possible to generate alert based on the above conditions instead of writing a custom script for it.

Needs suggestions from the experts.  
Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 9, 2018, 5:26pm UTC](https://discuss.elastic.co/t/update-field-based-on-values-in-multiple-documents/123601/2 "2018-04-09T17:26:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.