Copying Value From Existing Field

Elastic Stack Elasticsearch
1

Hi,

I have an index with data already indexed.
I want to add a multi-field to an already existing field and to copy the content of the said field in it.

PUT my_index
{
  "mappings": {
    "_doc": {
      "properties": {
        "name": {
          "type": "text",
}}}}}

POST /entite/_doc/102/{ "doc": {"name" : "Ted"}}

PUT my_index/_mapping/_doc
{
  "properties": {
    "name": {
      "type":  "text",
      "fields": {
            "raw": { 
              "type":  "keyword"}}}}}

But with this, name.raw is empty.
I want to have "Ted" indexed in it without having to repost it.
Is this possible?

NB: I've tried "copy_to" but this doesn't seem to work with multi-field.

2

It's not possible without reindexing. You can "upgrade" the field to have a multi-field (raw in this case), but all existing documents will have an empty name.raw as you discovered.

You'll have to index the docs again or use the reindex API.

This is done to make the cost explicit; imagine you have a petabyte of data and update the mapping to include a new mapping. If we auto-reindexed the field, there'd a petabyte of background reindexing that would get kicked off, and all sorts of dangerous edge-cases could pop up (what if the user changes it again during the process? What if the cluster crashes? etc etc).

3

Thank you.
And could you confirm me that this multi-field does not take any place in the source?
"Ted" would not be indexed twice as a name and a name.raw ?

4

Correct. Elasticsearch never alters the original JSON source, so what you send is what you get back in _source.

Mostly a confusion of terms, but technically "Ted" will be indexed twice. When you add a multifield, what you're doing is telling Elasticsearch to index the field different ways, using different analyzers. So the value will be added into an inverted index for each extra multi-field that you add.

It'll still only show up once in the _source, but internally it will be indexed multiple times to support the multi-field.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.