Added new field in elasticsearch


(anonymous) #1

Hi,

I have added new field in the existing index using-
POST honeypot/_mapping/type
{
"properties" :
{
"extract_only_url" :
{
"type":"string",
"index" :"not_analyzed"
}
}
}

Now when i try to access this index using python -

res = es.search(index = 'honeypot',size=honeyport_doc_count, body={"query": {"match_all": {}}})
print res

In the above response, newly added field is not visible in printing 'res'. I need to update this newly added field using python script.


(David Pilato) #2

You did not change previous documents but only the mapping.


(anonymous) #3

@dadoonet can you please tell me how to do that?


(David Pilato) #4

Reindex your documents.

If you index

{
  "foo": "bar"
}

Then update the mapping by adding a new field res there is no chance that your document have been updated magically.

It will come back as you indexed it:

{
  "foo": "bar"
}

(anonymous) #5

@dadoonet This is what i am asking, Basically i added new field in elasticsearch mapping but how can i add new field in all documents syntactically.
Reindexing basically copy all the document from old index to new index but how the new field will be added in documents?
if _update_by_query works for this,then how to write that?


(David Pilato) #6

How elasticsearch can know what is the value you want to set for this field?

You must provide it.

The best option IMO is to reindex all your data:

  • from the source. If the data is coming from your database, read its value and provide it to elasticsearch
  • using reindex API and ingest features.

Something like:

PUT _ingest/pipeline/my-pipeline-id
{
  "processors" : [
    {
      "set" : {
        "field": "foo",
        "value": "bar"
      }
    }
  ]
}
POST _reindex
{
  "source": {
    "index": "oldindex"
  },
  "dest": {
    "index": "newindex",
    "pipeline": "my-pipeline-id"
  }
}

(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.