How update the nested element in ES through Groovy

Elastic Stack Elasticsearch
1

How to update the nested field values in the ES Groovey.

curl -XPOST 'localhost:9200/iapi-log-dev-lorain/log/Sample.Test/_update' -d '{"script" : "ctx._source.@fields.Metrics.TOTAL_MSGS = TOTAL_MSGS","params" : {"TOTAL_MSGS" : 2200 } }'

{"error":"RemoteTransportException[[iapi-dev-lorain-node-2][inet[/11.120.39.149:9301]][indices:data/write/update]]; nested: ElasticsearchIllegalArgumentException[failed to execute script]; nested: GroovyScriptExecutionException[MissingFieldException[No such field: fields for class: java.util.LinkedHashMap]]; ","status":400}

Here is the ES document:

{
"@type": "iapi.log",
"@timestamp": "2017-09-02T03:34:45.399Z",
"@source_host": "my local desktop",
"@message": "TEST",
"@environment": "DEV",
"@fields": {
"AppID": "ABC",
"TransactionID": "12-203-809-49181-42-131-822980900282-5242-146873621",
"CorrelationID": "6f39b6d3-85fd-44e1-b30a-bb1dced34f25",
"TransactionDomain": "Inventory",
"ElapsedTime": "0",
"AppDomain": "DEV",
"Metrics": {
"Sample.Test": "DCR_EMS_STATS_RcvToCollSales",
"TOTAL_MSGS": 2000,
"MSGS_PENDING": 12,
"MSGS_FAILED": 1100
}
}
}'

2

This syntax is not correct. Try with:

ctx._source['@fields'].Metrics.TOTAL_MSG = TOTAL_MSGS
3

Thiago Thanks for the reponse.

still i am seeing the error saying that unable to see reslove class field.

"script": "ctx._source.Metrics.TOTAL_MSGS =+ my_modifier",
"params": {
"my_modifier": 8

{"error":"RemoteTransportException[[iapi-dev-lorain-node-2][inet[/11.120.39.149:9301]][indices:data/write/update]]; nested: ElasticsearchIllegalArgumentException[failed to execute script]; nested: GroovyScriptCompilationException[MultipleCompilationErrorsException[startup failed:\nb247a3641a4be9c42402976784c2b70a21f0612b: 1: unable to resolve class fields , unable to find class for annotation\n @ line 1, column 13.\n ctx._source[@fields].Metrics.TOTAL_MSGS =+ my_modifier\n ^\n\n1 error\n]]; ","status":400}[apache@esu1l338 scripts]$

4

According to the exception, you have removed the single-quote '. That's not what I suggested. Here is what I suggested:

ctx._source['@fields'].Metrics.TOTAL_MSGS = TOTAL_MSGS

Notice that '@fields' is surrounded by single-quotes.

5

Thiago : Please find the complete script.

Request :

curl -XPOST 'localhost:9200/iapi-log-dcr-dev-lorain/log/Sample.Test/_update' -d '{
"functions": [
{
"script_score": {
"script": "ctx._source['@fields'].Metrics.TOTAL_MSGS =+ my_modifier",
"params": {
"my_modifier": 8
}
}
}
]
}'

Exception:

{"error":"RemoteTransportException[[iapi-dev-lorain-node-2][inet[/11.120.39.149:9301]][indices:data/write/update]]; nested: ElasticsearchIllegalArgumentException[failed to execute script]; nested: GroovyScriptCompilationException[MultipleCompilationErrorsException[startup failed:\nb247a3641a4be9c42402976784c2b70a21f0612b: 1: unable to resolve class fields , unable to find class for annotation\n @ line 1, column 13.\n ctx._source[@fields].Metrics.TOTAL_MSGS =+ my_modifier\n ^\n\n1 error\n]]; ","status":400}[apache@esu1l338 scripts]$

6

What is the Elasticsearch version?

7

ES 1.7.5

8

This is a shell syntax/quoting issue. Using double-quotes will also works. Try with the following:

$ curl -XPOST 'localhost:9200/iapi-log-dcr-dev-lorain/log/Sample.Test/_update' -d '{
  "functions": [
    {
      "script_score": {
        "script": "ctx._source[\"@fields\"].Metrics.TOTAL_MSGS =+ my_modifier",
        "params": {
          "my_modifier": 8
        }
      }
    }
  ]
}'
9

It is working fine Thiago.

Thanks a lot.

May I know what is issue for below statement ?

ctx._source. @fields.Metrics.TOTAL_MSGS

10

The @ is not a valid field name character that can be used with that field access syntax in particular.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.