[Help Needed] How to modify specific field value

Elastic Stack Elasticsearch
1

Sorry I am new to ES. I have to give quick demo on my application log analysis.

Question:

  • I have several documents which have field name logname='APPLog'
  • I wanted to change field to 'AppLog' wherever it has 'APPLog'

in summary update:
from: logname='APPLog'
to: logname='AppLog'

Can anyone give exact query?

2

You can give a look at update by query in the docs.

But do you really to change it? Is it for display purpose? For search? Aggregations?

3

Only for aggregation.

I have pumped many documents but I have made mistake in logstash so few documents have typo. So kibana aggregations give separate barchart for terms( though I changed to uppercase in kibana).

4

Yeah. I see.
Ideally in a next version of elasticsearch, we will support an option to lowercase keyword fields.

Are you using elasticsearch 5.0?