Add field to existing document by query?

Elastic Stack Elasticsearch
1

Hi folks,

I want to add a new field to multiple existing documents.

e.g.

All documents that have the value "93.22.14.132" in the field "ip" should get the field "status" with the value "okay".

Is there a built-in api of ES that allows me to do that or do i need to fetch all IDs of the documents with the matching ip first and than update it one-by-one?

Any feedback is appreciated

1 Like
2

Hi,

you can use the Update By Query Api for this that is available since version 2.3. In your example, it would look something like:

POST index/_update_by_query
{
  "script": {
    "inline": "ctx._source.status = \"okay\"",
    "lang": "painless"
  },
  "query": {
    "match": {
      "ip": "93.22.14.132"
    }
  }
}

but this might vary depending on your version of elasticsearch.

3 Likes
3

I am using ES2.4 currently,

After enabling the inline_scripting in the elasticsearch config (script.inline: true ) and removing the "lang" parameter (painless is 5.X only as far as i know), this command did the exact thing i wanted to do.

Thank you very much!

4

In 5.x you shouldn't have to enabled inline scripting for painless. It is enabled by default.

You do have the option of using "lang": "groovy" and for that you'd have to enable inline scripting.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.