# Batch update documents with new fields **URL:** \ **Category:** Elasticsearch\ **Created:** [January 18, 2013, 9:26pm UTC](https://discuss.elastic.co/t/batch-update-documents-with-new-fields/10416 "2013-01-18T21:26:58Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Kubes](https://avatars.discourse-cdn.com/v4/letter/k/a9adbd/32.png) [@Kubes](https://discuss.elastic.co/u/Kubes)\ **Post date:** [January 18, 2013, 9:26pm UTC](https://discuss.elastic.co/t/batch-update-documents-with-new-fields/10416/1 "2013-01-18T21:26:58Z")
I am looking to add new fields based on the parsing of an existing field. The documents are apache acccess logs entreis and are already indexed. I want to add new fields on a parsed user agemt to add browser, os and type,etc. 1. A facet query by user agent to return the top user agents. 2. Parse the returned facet user agents and create new fields for browser, os and type for each 3. Query each user agent from #1, to obtin a lsit of document ids. 4. Use the update api to add the fields from #2 to each documetn of #3 (loop though the list) Is there a better measn to acomplsih this? Thanks -- ---
**Author:** ![mattweber](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattweber/32/44940_2.png) [@mattweber](https://discuss.elastic.co/u/mattweber)\ **Post date:** [January 18, 2013, 9:41pm UTC](https://discuss.elastic.co/t/batch-update-documents-with-new-fields/10416/2 "2013-01-18T21:41:29Z")
1. Perform matchall scan search 2. For each doc/log, a. get user agent field b. parse out the additional information and create a partial update "doc" ([Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/api/update.html)) c. perform the partial update Better yet, do this additional parsing at original index time. BTW, have you looked into logstash? ([http://logstash.net/](http://logstash.net/)) On Fri, Jan 18, 2013 at 1:26 PM, Kubes [philip@freepricealerts.com](mailto:philip@freepricealerts.com) wrote: > I am looking to add new fields based on the parsing of an existing field. > > The documents are apache acccess logs entreis and are already indexed. I > want to add new fields on a parsed user agemt to add browser, os and > type,etc. > > 1. A facet query by user agent to return the top user agents. > 2. Parse the returned facet user agents and create new fields for > browser, os and type for each > 3. Query each user agent from #1, to obtin a lsit of document ids. > 4. Use the update api to add the fields from #2 to each documetn of #3 > (loop though the list) > > Is there a better measn to acomplsih this? > > Thanks > > -- -- ---
**Author:** ![Kubes](https://avatars.discourse-cdn.com/v4/letter/k/a9adbd/32.png) [@Kubes](https://discuss.elastic.co/u/Kubes)\ **Post date:** [January 18, 2013, 10:05pm UTC](https://discuss.elastic.co/t/batch-update-documents-with-new-fields/10416/3 "2013-01-18T22:05:08Z")
Matt, Thanks. I am using logstash, but these are already indexed documents. In the future I was thinking a creating a LS filter plug-in to fix the issue. As in parsing the user agent I was planning to use a external lookup service via an api ([http://useragentstring.com](http://useragentstring.com)) On Friday, January 18, 2013 4:41:29 PM UTC-5, Matt Weber wrote: > 1. Perform matchall scan search > 2. For each doc/log, > a. get user agent field > b. parse out the additional information and create a partial > update "doc" ([Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/api/update.html) > ) > c. perform the partial update > > Better yet, do this additional parsing at original index time. BTW, have > you looked into logstash? ([http://logstash.net/](http://logstash.net/)) > > On Fri, Jan 18, 2013 at 1:26 PM, Kubes \<[phi...@freepricealerts.com](mailto:phi...@freepricealerts.com)\ > > > wrote: > > > I am looking to add new fields based on the parsing of an existing field. > > > > The documents are apache acccess logs entreis and are already indexed. I > > want to add new fields on a parsed user agemt to add browser, os and > > type,etc. > > > > 1. A facet query by user agent to return the top user agents. > > 2. Parse the returned facet user agents and create new fields for > > browser, os and type for each > > 3. Query each user agent from #1, to obtin a lsit of document ids. > > 4. Use the update api to add the fields from #2 to each documetn of #3 > > (loop though the list) > > > > Is there a better measn to acomplsih this? > > > > Thanks > > > > -- -- ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:55am UTC](https://discuss.elastic.co/t/batch-update-documents-with-new-fields/10416/4 "2017-07-06T02:55:36Z")