Append nested object to exisiting nested field in elasticsearch

Elastic Stack Elasticsearch
1

I'm having nested object like below

"appdata": {
"type":"nested",
"include_in_parent":true,
"properties": {
"accessType": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"appname": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"eventtime": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}

I'm updating it using below

POST dashboard_write/_update/1199CF2F77603304A275DD112D9FA747
{

"script" : {

    "source": "if (ctx._source.appdata == null) { ctx._source.appdata = params.appdata } else { ctx._source.appdata=ctx._source.appdata+params.appdata}",

    "lang": "painless",

    "params" : {

        "appdata" : {
        "accessType" : "second_app",
        "appname" : "third",
        "eventtime" : "Jan 20 12:18:39"
      }

    }

}

It's giving runtime error

"type": "class_cast_exception",
"reason": "Cannot apply [+] operation to types [java.util.LinkedHashMap] and [java.util.HashMap]."

I'm expecting appdata to be as below

"appdata" : [{
"accessType" : "test_app",
"appname" : "first",
"eventtime" : "Jan 20 12:18:39"
},{
"accessType" : "test_app",
"appname" : "second",
"eventtime" : "Jan 20 12:18:39"
},]

2

This is config issue from my side. Above code works well for logstash too.. Thanks

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.