One index field update based on some condition on field of another index

Elastic Stack Elasticsearch
1

Hi Elastic Team,

I have two index with below fields.

Index1:
index1 has 2 below fields.
RRN Flag
1 nofraud
2 nofraud
3 nofraud
4 fraud

Index2:
this has only 1 field

RRN
1
2
3
10
15

Requirement: We need to update flag fields values of index1 from "nofraud" to "fraud" if for all RRN of index1 which have matching RRN values in index2.

Please suggest how to do.I understand elaticsearch is nosql hence we can not join 2 indexes.But is there any other alternate way to do this

Thanks
Sarvendra

2

@ Elastic Team ..Please suggest..

3

If this is a one-off fix or update I would recommend using update by query. Either run one task per value or a single task with a script that sets the value correctly based on the data in the event.

4

Thanks for reply..but how we can do using update by query... here data is on two different indexes .in update by query elastic documentation all the examples are given using update based on some condition within same index..

Can yopu please share any example how we can do this with update query with 2 indexs..

Thanks
Sarvendra

5

You would need to specify the content of the reference index as parameters to your update by query as you correctly cannot do it from one index to another. You could run one update by query per RRN or put the mapping of a few values at a time in a scripted update. If you have a large number of values it may be easier to create an external reindexing script.

6

Thanks Christian.Can you please any example to get how to implement as you suggested.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.