Data gets deleted on update by query when the _source field is set on the body

Elastic Stack Elasticsearch
1

Hello,

I ran into an interesting case upon executing an update_by_query instruction.
First, I've executed the instruction with only the query field. As it is specified in the documentation, nothing happens with the data. The operation reports updates, but the matched documents aren't really updated as there is no statement demanding that.
Afterwards, I've added a _source field on the request body. After executing the query, I was a bit surprised to find out that the matched documents got deleted.

My question is: is this the expected behavior? I've read the docs, but I couldn't find out any clues on what should happen when using the _source field on an update_by_query.
For the _update instruction, the _source field behaves the same way as it behaves on the _search instruction.

Thank you in advance,
Ionut

2

Hi @ibreta

Update by query consists of a scrolled search request with bulk updates, so the _source parameter is passed to scrolled search and determines what part of the source document is returned. If you set it to false, then update by query will throw an exception saying (eg) [myindex][mytype][1] didn't store _source . If you set it to something else (like a list of field names), then only those field names will be present in the new documents.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.