Added new field in elasticsearch

[anonymous]

Hi,

I have added new field in the existing index using-
POST honeypot/_mapping/type
{
"properties" :
{
"extract_only_url" :
{
"type":"string",
"index" :"not_analyzed"
}
}
}

Now when i try to access this index using python -

res = es.search(index = 'honeypot',size=honeyport_doc_count, body={"query": {"match_all": {}}})
print res

In the above response, newly added field is not visible in printing 'res'. I need to update this newly added field using python script.

[dadoonet (David Pilato)]

You did not change previous documents but only the mapping.

[anonymous]

@dadoonet can you please tell me how to do that?

[dadoonet (David Pilato)]

Reindex your documents.

If you index

{
  "foo": "bar"
}

Then update the mapping by adding a new field res there is no chance that your document have been updated magically.

It will come back as you indexed it:

{
  "foo": "bar"
}

[anonymous]

@dadoonet This is what i am asking, Basically i added new field in elasticsearch mapping but how can i add new field in all documents syntactically.
Reindexing basically copy all the document from old index to new index but how the new field will be added in documents?
if _update_by_query works for this,then how to write that?

[dadoonet (David Pilato)]

How elasticsearch can know what is the value you want to set for this field?

You must provide it.

The best option IMO is to reindex all your data:

• from the source. If the data is coming from your database, read its value and provide it to elasticsearch
• using reindex API and ingest features.

Something like:

PUT _ingest/pipeline/my-pipeline-id
{
  "processors" : [
    {
      "set" : {
        "field": "foo",
        "value": "bar"
      }
    }
  ]
}
POST _reindex
{
  "source": {
    "index": "oldindex"
  },
  "dest": {
    "index": "newindex",
    "pipeline": "my-pipeline-id"
  }
}