[Help Needed] How to modify specific field value

(Ramesh Janagam) #1

Sorry I am new to ES. I have to give quick demo on my application log analysis.


  • I have several documents which have field name logname='APPLog'
  • I wanted to change field to 'AppLog' wherever it has 'APPLog'

in summary update:
from: logname='APPLog'
to: logname='AppLog'

Can anyone give exact query?

(David Pilato) #2

You can give a look at update by query in the docs.

But do you really to change it? Is it for display purpose? For search? Aggregations?

(Ramesh Janagam) #3

Only for aggregation.

I have pumped many documents but I have made mistake in logstash so few documents have typo. So kibana aggregations give separate barchart for terms( though I changed to uppercase in kibana).

(David Pilato) #4

Yeah. I see.
Ideally in a next version of elasticsearch, we will support an option to lowercase keyword fields.

Are you using elasticsearch 5.0?

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.