Add field to existing document by query?

(Horst Birne) #1

Hi folks,

I want to add a new field to multiple existing documents.


All documents that have the value "" in the field "ip" should get the field "status" with the value "okay".

Is there a built-in api of ES that allows me to do that or do i need to fetch all IDs of the documents with the matching ip first and than update it one-by-one?

Any feedback is appreciated

(Christoph) #2


you can use the Update By Query Api for this that is available since version 2.3. In your example, it would look something like:

POST index/_update_by_query
  "script": {
    "inline": "ctx._source.status = \"okay\"",
    "lang": "painless"
  "query": {
    "match": {
      "ip": ""

but this might vary depending on your version of elasticsearch.

(Horst Birne) #3

I am using ES2.4 currently,

After enabling the inline_scripting in the elasticsearch config (script.inline: true ) and removing the "lang" parameter (painless is 5.X only as far as i know), this command did the exact thing i wanted to do.

Thank you very much!

(Nik Everett) #4

In 5.x you shouldn't have to enabled inline scripting for painless. It is enabled by default.

You do have the option of using "lang": "groovy" and for that you'd have to enable inline scripting.

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.