Added new field in elasticsearch

(anonymous) #1


I have added new field in the existing index using-
POST honeypot/_mapping/type
"properties" :
"extract_only_url" :
"index" :"not_analyzed"

Now when i try to access this index using python -

res = = 'honeypot',size=honeyport_doc_count, body={"query": {"match_all": {}}})
print res

In the above response, newly added field is not visible in printing 'res'. I need to update this newly added field using python script.

(David Pilato) #2

You did not change previous documents but only the mapping.

(anonymous) #3

@dadoonet can you please tell me how to do that?

(David Pilato) #4

Reindex your documents.

If you index

  "foo": "bar"

Then update the mapping by adding a new field res there is no chance that your document have been updated magically.

It will come back as you indexed it:

  "foo": "bar"

(anonymous) #5

@dadoonet This is what i am asking, Basically i added new field in elasticsearch mapping but how can i add new field in all documents syntactically.
Reindexing basically copy all the document from old index to new index but how the new field will be added in documents?
if _update_by_query works for this,then how to write that?

(David Pilato) #6

How elasticsearch can know what is the value you want to set for this field?

You must provide it.

The best option IMO is to reindex all your data:

  • from the source. If the data is coming from your database, read its value and provide it to elasticsearch
  • using reindex API and ingest features.

Something like:

PUT _ingest/pipeline/my-pipeline-id
  "processors" : [
      "set" : {
        "field": "foo",
        "value": "bar"
POST _reindex
  "source": {
    "index": "oldindex"
  "dest": {
    "index": "newindex",
    "pipeline": "my-pipeline-id"

(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.