Painless Script in Ingest - Rename Field

Elastic Stack Elasticsearch
,
1

Hello there,

Using an ingest pipeline, I am trying to uppercase the first char in a fieldname, for all fields under winlog.event_data:

  {
    "script": {
      "lang": "painless",
      "source": "ctx._source.winlog.event_data = ctx._source.last.replaceFirst(/[a-z]/, m ->\n  m.group().toUpperCase(Locale.ROOT))"
    }        
  },

How do I reference the field name within Painless, rather than the field value? To be clear, there are multiple fields under winlog.event_data

** Edited to add the following relevant Issue, as this is essentially what I need to do:

2

Bump...

3

Hi @DefensiveDepth, ctx is a Map of maps (and lists, depending on the document), so you can remove keys in place or replace the map entirely. For example:

POST /_ingest/pipeline/_simulate?verbose=true
{
  "pipeline": {
    "processors": [
      {
        "script": {
          "lang": "painless", 
          "source": """
          Map eventData = ctx['winlog']['event_data'];
          Map updatedEventData = new HashMap();
          for (String key: eventData.keySet()) {
            updatedEventData[key.substring(0,1).toUpperCase() + key.substring(1)] = eventData[key]
          }
          ctx['winlog']['event_data'] = updatedEventData
          """
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "winlog": {
          "event_data": {
            "abc": 123,
            "def": "hij"
          }
        }
      }
    }
  ]
}

Results:

{
  "docs" : [
    {
      "processor_results" : [
        {
          "processor_type" : "script",
          "status" : "success",
          "doc" : {
            "_index" : "_index",
            "_type" : "_doc",
            "_id" : "_id",
            "_source" : {
              "winlog" : {
                "event_data" : {
                  "Def" : "hij",
                  "Abc" : 123
                }
              }
            },
            "_ingest" : {
              "pipeline" : "_simulate_pipeline",
              "timestamp" : "2022-01-05T16:02:13.747478961Z"
            }
          }
        }
      ]
    }
  ]
}
4

Fantastic, thanks so much @stu !

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.