Reindexing datetime field with an script expression

Elastic Stack Elasticsearch
1

Hi,

I'm not even sure whether it's possible or not. The problem is I didn't define the datetime format from the beginning and elasticsearch assumes it was in UTC and added 8 hours on every document. So I did following:

POST _reindex
{
  "source": {
    "index": "previous-index"
  },
  "dest": {
    "index": "new-index"
  },
    "script": {
    "lang":   "expression",
    "inline": "ctx._source['datetime'] - multiplier",
    "params": {
      "multiplier": "8h"
    }
  }
}

Which gives me an following:
{
"error": {
"root_cause": [
{
"type": "unsupported_operation_exception",
"reason": "scripts of type [inline], operation [update] and lang [expression] are not supported"
}
],
"type": "unsupported_operation_exception",
"reason": "scripts of type [inline], operation [update] and lang [expression] are not supported"
},
"status": 500
}

Added following entry to elasticsearch.yml but no luck.
script.engine.groovy.inline.update: on
Any way to solve this issue? Thanks!

2

You are explicitly specifying an expression script (which is not groovy, expression is its own language, from lucene). As the error message states, expressions cannot be used for update scripts (they are numeric only). If you are on 5.0+, you can try painless. Note that accessing the field from _source you will get back a string (since this is how dates are serialized), so simply doing a subtraction like that will not. You will need to parse the date and then adjust it.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.