title: Logstash -> Elasticsearch : update document @timestamp if newer, discard if older
body: <p>Using the <code>elasticsearch output</code> in <code>logstash</code>, how can i update only the <code>@timestamp</code> for a log message if newer?</p>
  
  <p>I don't want to reindex the whole document, nor have the same log message indexed twice.</p>
  
  <p>Also, if the <code>@timestamp</code> is older, it must not update/replace the current version.</p>
  
  <p>Currently, i'm doing this:</p>
  
  <pre><code>filter {
      if ("cloned" in [tags]) {
          fingerprint {
              add_tag =&gt; [ "lastlogin" ]
              key     =&gt; "lastlogin"
              method  =&gt; "SHA1"
          }
      }
  }
  
  output {
      if ("cloned" in [tags]) {
          elasticsearch {
              action              =&gt; "update"
              doc_as_upsert       =&gt; true
              document_id         =&gt; "%{fingerprint}"
              index               =&gt; "lastlogin-%{+YYYY.MM}"
              sniffing            =&gt; true
              template_overwrite  =&gt; true
          }
      }
  }
  </code></pre>
  
  <hr>
  
  <p>It is similar to <a href="https://stackoverflow.com/questions/25037289/how-to-deduplicate-documents-while-indexing-into-elasticsearch-from-logstash">How to deduplicate documents while indexing into elasticsearch from logstash</a> but i do not want to always update the <code>message</code> field; only if the <code>@timestamp</code> field is more recent.</p>