# \[Help Needed\] How to modify specific field value

**URL:** <https://discuss.elastic.co/t/help-needed-how-to-modify-specific-field-value/67430>\
**Category:** Elasticsearch\
**Created:** [November 29, 2016, 3:16am UTC](https://discuss.elastic.co/t/help-needed-how-to-modify-specific-field-value/67430 "2016-11-29T03:16:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ramesh\_Janagam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramesh_janagam/32/11718_2.png) [@Ramesh\_Janagam](https://discuss.elastic.co/u/Ramesh_Janagam)\
**Post date:** [November 29, 2016, 3:16am UTC](https://discuss.elastic.co/t/help-needed-how-to-modify-specific-field-value/67430/1 "2016-11-29T03:16:41Z")

</div>

Sorry I am new to ES. I have to give quick demo on my application log analysis.

Question:

- I have several documents which have field name logname='APPLog'
- I wanted to change field to 'AppLog' wherever it has 'APPLog'

in summary update:  
from: logname='APPLog'  
to: logname='AppLog'

Can anyone give exact query?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 29, 2016, 6:05am UTC](https://discuss.elastic.co/t/help-needed-how-to-modify-specific-field-value/67430/2 "2016-11-29T06:05:29Z")

</div>

You can give a look at update by query in the docs.

But do you really to change it? Is it for display purpose? For search? Aggregations?

---

<div class="post-metadata">

**Author:** ![Ramesh\_Janagam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramesh_janagam/32/11718_2.png) [@Ramesh\_Janagam](https://discuss.elastic.co/u/Ramesh_Janagam)\
**Post date:** [November 29, 2016, 7:50am UTC](https://discuss.elastic.co/t/help-needed-how-to-modify-specific-field-value/67430/3 "2016-11-29T07:50:41Z")

</div>

Only for aggregation.

I have pumped many documents but I have made mistake in logstash so few documents have typo. So kibana aggregations give separate barchart for terms( though I changed to uppercase in kibana).

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 29, 2016, 9:11am UTC](https://discuss.elastic.co/t/help-needed-how-to-modify-specific-field-value/67430/4 "2016-11-29T09:11:34Z")

</div>

Yeah. I see.  
Ideally in a next version of elasticsearch, we will support an option to `lowercase` `keyword` fields.

> <https://github.com/elastic/elasticsearch/issues/18064>

Are you using elasticsearch 5.0?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 27, 2016, 9:11am UTC](https://discuss.elastic.co/t/help-needed-how-to-modify-specific-field-value/67430/5 "2016-12-27T09:11:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.