# Bulk update in ES **URL:** \ **Category:** Elasticsearch\ **Created:** [September 21, 2018, 6:27pm UTC](https://discuss.elastic.co/t/bulk-update-in-es/149503 "2018-09-21T18:27:44Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Gosforth](https://avatars.discourse-cdn.com/v4/letter/g/f08c70/32.png) [@Gosforth](https://discuss.elastic.co/u/Gosforth)\ **Post date:** [September 21, 2018, 6:27pm UTC](https://discuss.elastic.co/t/bulk-update-in-es/149503/1 "2018-09-21T18:27:44Z")
How can I update millions of docs in E? I found this [https://www.elastic.co/guide/en/elasticsearch/reference/current/\_updating\_documents.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/_updating_documents.html) but I cannot imagine this can be done with millions of rows. Even writing some script that will simulate this is a pain. Logstash can update documents? I want to add one field and update existing. Regards ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 24, 2018, 9:50am UTC](https://discuss.elastic.co/t/bulk-update-in-es/149503/2 "2018-09-24T09:50:40Z")
Have you looked into using the [update by query API](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/docs-update-by-query.html)? ---
**Author:** ![fkelbert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fkelbert/32/35762_2.png) [@fkelbert](https://discuss.elastic.co/u/fkelbert)\ **Post date:** [September 24, 2018, 9:58am UTC](https://discuss.elastic.co/t/bulk-update-in-es/149503/3 "2018-09-24T09:58:34Z")
`_udpate_by_query`, as suggested by @Christian_Dahlqvist is certainly what you are looking for. It is quite powerful by allowing to update documents using [Painless scripts](https://www.elastic.co/guide/en/elasticsearch/reference/master/modules-scripting-painless.html). Bear in mind, however, that document updates will actually index new documents and delete the old ones. As such, depending on your use case, you might also want to consider to [`reindex`](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html) into a new index, updating the documents (potentially using Painless scripts) while reindexing. ---
**Author:** ![Gosforth](https://avatars.discourse-cdn.com/v4/letter/g/f08c70/32.png) [@Gosforth](https://discuss.elastic.co/u/Gosforth)\ **Post date:** [September 27, 2018, 5:51pm UTC](https://discuss.elastic.co/t/bulk-update-in-es/149503/4 "2018-09-27T17:51:29Z")
Thanks for your suggestion however I understand nothing from this documentation. `POST twitter/_update_by_query?conflicts=proceed` This is POST method or POST command in Kibana console (100 millions time to execute)? Same about example: `POST twitter/_update_by_query?conflicts=proceed { "query": { ![](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/images/icons/callouts/1.png) "term": { "user": "kimchy" } } }` POST is http method and Json is payload or 'POST' is console command? If you mean console command; this is not API. Suppose I want to update 'some\_field' in index where this field has 'value\_X' what I should do? Something like in SQL `UPDATE`table\_name`SET`column\_name`=`new\_value' [WHERE condition];` Regards ---
**Author:** ![fkelbert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fkelbert/32/35762_2.png) [@fkelbert](https://discuss.elastic.co/u/fkelbert)\ **Post date:** [September 28, 2018, 8:53am UTC](https://discuss.elastic.co/t/bulk-update-in-es/149503/5 "2018-09-28T08:53:41Z")
Yes, the commands in the documentation are supposed to be used in the Kibana developer console. But these can always be translated into, e.g., curl commands. Quoting [Update By Query API](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/docs-update-by-query.html): > Back to the API format, this will update [_all_] tweets from the `twitter` index: > > `POST twitter/_doc/_update_by_query?conflicts=proceed` The documentation also describes how to update documents for which a certain criterion matches: > You can also limit `_update_by_query` using the [Query DSL](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/query-dsl.html). This will update all documents from the `twitter` index for the user `kimchy` : ```auto POST twitter/_update_by_query?conflicts=proceed { "query": { "term": { "user": "kimchy" } } } ``` ---
**Author:** ![Gosforth](https://avatars.discourse-cdn.com/v4/letter/g/f08c70/32.png) [@Gosforth](https://discuss.elastic.co/u/Gosforth)\ **Post date:** [September 28, 2018, 1:38pm UTC](https://discuss.elastic.co/t/bulk-update-in-es/149503/6 "2018-09-28T13:38:34Z")
Thank you. What about REST WS; I'd like to use POST and send JSON as payload. ---
**Author:** ![fkelbert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fkelbert/32/35762_2.png) [@fkelbert](https://discuss.elastic.co/u/fkelbert)\ **Post date:** [September 28, 2018, 2:10pm UTC](https://discuss.elastic.co/t/bulk-update-in-es/149503/7 "2018-09-28T14:10:47Z")
Just send a corresponding REST request: ```auto curl -X POST "localhost:9200/twitter/_update_by_query?conflicts=proceed" -H 'Content-Type: application/json' -d' { "query": { "term": { "user": "kimchy" } } } ' ``` ---
**Author:** ![Gosforth](https://avatars.discourse-cdn.com/v4/letter/g/f08c70/32.png) [@Gosforth](https://discuss.elastic.co/u/Gosforth)\ **Post date:** [October 5, 2018, 4:55pm UTC](https://discuss.elastic.co/t/bulk-update-in-es/149503/8 "2018-10-05T16:55:27Z")
Thank you but what this query will do? Update ALL user fields to value 'kimchy'? Hmmm... who needs such query. I'd like to include WHERE clause. I.e: update filed 'something' where filed 'user' is some value. ``` { "query": { "term": { "user": "kimchy" } } } ``` According the documentation this should work: `{"script": {"postal_code": "56789"},"query": { "match": {"client_name": "some company"}} }` But it does not. Tried (not logical but works for some reason): `{"query": { "match": {"client_name": "some company"}},"script": "ctx._source.postal code = '56789'" }` Answer from ES is: `{"took":79,"timed_out":false,"total":1,"updated":1,"deleted":0,"batches":1,"version_conflicts":0,"noops":0,"retries":{"bulk":0,"search":0},"throttled_millis":0,"requests_per_second":-1.0,"throttled_until_millis":0,"failures":[]}` But this is not true. It updates nothing. What to do to put new field in index with WHERE clause? And what to do this filed is visible in index pattern? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 2, 2018, 4:55pm UTC](https://discuss.elastic.co/t/bulk-update-in-es/149503/9 "2018-11-02T16:55:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.