How to extract _ttl field value on documents

Elastic Stack Elasticsearch
1

Hello,
I am migrating my 2.x indices to 6.x (to time based indices). My 2.x index has _ttl on them and no created timestamp, for me to migrate the index to 6.x cluster, I need to know the timestamp when the document is created, so i can place them in proper index in 6.x cluster, but unfortunately I am not able to fetch the _ttl field on the document (as mentioned by some people).

tried this with no luck

curl -XPOST -H "Content-Type: application/json" 'https://localhost:9200/index_v1/_search' -d'{
     "fields": ["_ttl"],
     "query": {
         "match_all": {}
     }
 }'

Is there a way i can get _ttl value on the document on 2.x cluster ?

Thanks

2

I'm not sure why it won't work through fields, but the ttl field was stored by default in 2.x, so you could try a script field, and access it with _fields['_ttl'].

3

That didn't work too

curl -XPOST -H "Content-Type: application/json" 'http://localhost:9200/index_v1/_search?pretty' -d '
{
  "query"  : { "match_all" : {} },
  "script_fields" : {
    "test" : {
      "script" : "_fields['_ttl']"
    }
  }
}'
{
  "took" : 4,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 4,
    "failed" : 1,
    "failures" : [ {
      "shard" : 0,
      "index" : "index_v1",
      "node" : "mDZ5XrzMTmSxlNPRko4p6Q",
      "reason" : {
        "type" : "script_exception",
        "reason" : "failed to run inline script [_fields[_ttl]] using lang [groovy]",
        "caused_by" : {
          "type" : "missing_property_exception",
          "reason" : "No such property: _ttl for class: c98975b952ef7f243a7e138611da53f620a7532e"
        }
      }
    } ]
  },
  "hits" : {
    "total" : 195841,
    "max_score" : 1.0,
    "hits" : [ ]
  }
}
4

Could you show your mappings for ttl?

curl -XGET 'http://localhost:9200/index_v1/_mapping/*/field/_ttl'`
5 
{
  "index_v1": {
    "mappings": {
      "test": {
        "_ttl": {
          "full_name": "_ttl",
          "mapping": {
            "_ttl": {
              "enabled": true,
              "default": 7862400000
            }
          }
        }
      }
    }
  }
}
6

Ok I see it now. Notice in the error message the single quotes are missing from your script around _ttl:

failed to run inline script [_fields[_ttl]]

Your curl data is encapsulated with single quotes. You need to escape them so they are passed through to elasticsearch.

7

OMG! that works. Thank you very much, really overlooked that

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.