# Use logstash to modify an event previously saved to elasticsearch

**URL:** <https://discuss.elastic.co/t/use-logstash-to-modify-an-event-previously-saved-to-elasticsearch/93529>\
**Category:** Logstash\
**Created:** [July 18, 2017, 8:57am UTC](https://discuss.elastic.co/t/use-logstash-to-modify-an-event-previously-saved-to-elasticsearch/93529 "2017-07-18T08:57:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cmpashayan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cmpashayan/32/19895_2.png) [@cmpashayan](https://discuss.elastic.co/u/cmpashayan)\
**Post date:** [July 18, 2017, 8:57am UTC](https://discuss.elastic.co/t/use-logstash-to-modify-an-event-previously-saved-to-elasticsearch/93529/1 "2017-07-18T08:57:09Z")

</div>

Specifically, I'm trying to tag the last event prior to an exception. So, when you encounter an event that matches some criterion, go back and find the last event and then add a tag to it. Is this possible?

I assume there are more convenient ways to handle this stuff down the pipeline. Kibana, for instance, should make this pretty easy. But I'm wondering whether there's a way to do it specifically within logstash.

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [July 21, 2017, 3:12pm UTC](https://discuss.elastic.co/t/use-logstash-to-modify-an-event-previously-saved-to-elasticsearch/93529/2 "2017-07-21T15:12:27Z")

</div>

I think this would be best achieved with our [Watcher](https://www.elastic.co/guide/en/watcher/current/introduction.html) product. You'd want to setup a watch that would look for exceptions, then query for the event occurring previous to that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 18, 2017, 3:13pm UTC](https://discuss.elastic.co/t/use-logstash-to-modify-an-event-previously-saved-to-elasticsearch/93529/3 "2017-08-18T15:13:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.