Converting a string field to an IP field

Elastic Stack Elasticsearch
1

I have a bunch of log data that contains three IP fields, but these have been shipped as a string.
I have created a new index template that defines these fields as IP now, and new data is coming in nicely, because my app passes in null for fields that don't have a valid IP, but if I _reindex my existing data, I get errors due to the empty strings that are currently in there.

Is there any way of using painless scripts or something to catch invalid addresses on the way through and replacing them with nulls, instead of just abandoning the reindex?

The closest I could find was something like this:

POST _reindex
{
  "source": {
    "index": "twitter"
  },
  "dest": {
    "index": "new_twitter"
  },
  "script": {
    "inline": "if (ctx._source.ip == '') {ctx._source.ip = null}",
    "lang": "painless"
  }
}

How would I run that snippet on three separate fields?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.