What I mean is, it cannot do update operations on ES or any other storage system. It simply inserts stuff.

With the architectures we're investigating, we have a database (ES or something else) where we keep a map of <clientId,sdkVersion> to exactly know what versions are in use.

Unfortunately, we can't simply aggregate data and figure out this information from events inserted. We need to maintain some map (an index in ElasticSearch, table in TimescaleDB/Postgres).