How to reindex and add new field?

Elastic Stack Elasticsearch
1

Hi,

Currently I have two versions of a field in different indexes. Here I use session.id and there I use sessionId.

I will make them equal in logstash for new values, but how can I change the old data via reindex?
I want to create an additional field sessionId and this field needs to have the value of session.id

I tried

  "script": {
    "source": "ctx._source['sessionId'] = ctx._source['[session][id]']",
    "lang": "painless"
  }

and

  "script": {
    "source": "ctx._source['sessionId'] = ctx._source['session.id']",
    "lang": "painless"
  }

but alwayss sessionId is null.

What is the correct syntax?

2

i had to do something similar due to the change from filebeat mapping side and here is the script that i used
but i have it the other way around (a string must be written in an object)

"script": {
    "source": "if (ctx._source.host instanceof String) {String host=ctx._source.host;ctx._source.host=['name':host];}"
  }

you could try to access your sessionid with

ctx._source.session.id

or

ctx._source['session']['id']
1 Like
3

great, thanks for your explanation. For me it doesn't currently matter which direction I use - at least for the upcoming showcase.

I used followig to write the value of sessionId to session.id:

 "script": {
    "source": "if (ctx._source.sessionId instanceof String) {String id=ctx._source.sessionId;ctx._source['session']=['id':id];}",
    "lang": "painless"
  }

Thanks a lot.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.