How to reindex and add new field?



Currently I have two versions of a field in different indexes. Here I use and there I use sessionId.

I will make them equal in logstash for new values, but how can I change the old data via reindex?
I want to create an additional field sessionId and this field needs to have the value of

I tried

  "script": {
    "source": "ctx._source['sessionId'] = ctx._source['[session][id]']",
    "lang": "painless"


  "script": {
    "source": "ctx._source['sessionId'] = ctx._source['']",
    "lang": "painless"

but alwayss sessionId is null.

What is the correct syntax?

(Christian Stockhaus) #2

i had to do something similar due to the change from filebeat mapping side and here is the script that i used
but i have it the other way around (a string must be written in an object)

"script": {
    "source": "if ( instanceof String) {String;['name':host];}"

you could try to access your sessionid with



great, thanks for your explanation. For me it doesn't currently matter which direction I use - at least for the upcoming showcase.

I used followig to write the value of sessionId to

 "script": {
    "source": "if (ctx._source.sessionId instanceof String) {String id=ctx._source.sessionId;ctx._source['session']=['id':id];}",
    "lang": "painless"

Thanks a lot.

(system) closed #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.