Replace content of field without deleting other content of id

Elastic Stack Elasticsearch
1

Hello everybody,

Let's say I have the following mapping:

curl -X PUT "localhost:9200/test/map1/_mapping" -d '{

"map1" : {
    "properties" : {
        "user" : {"type" : "string"},
        "message" : {"type" : "string", "null_value" : "na"},
        "postDate" : {"type" : "date"},
        "priority" : {"type" : "integer"},
        "rank" : {"type" : "float"}
    }
}

}'

and I post an arbitrary content to it (like user and message) and now put
again a field, which is not yet specified for the id, it is just added.
Any search queries work fine now.

If I change the content of one field already existing, the content of all
the other fields vanishes and only the replaced content remains.

Let's say, for id 1 I filled all fields and now want to replace "message"
without any change to the remaining fields "user", "postdate" etc.

First entry:

curl -XPUT 'localhost:9200/test/map2/1' -d '{
"user":"esuser",
"message":"esftw",
"postDate":"20111008"
}'

Replace :

curl -XPUT 'localhost:9200/test/map2/1' -d '{
"message":"esrulez",
}'

Any search now returns:

{
"_index" : "test",
"_type" : "map2",
"_id" : "1",
"_version" : 7,
"exists" : true, "_source" : { "message" : "esrulz" }
}

instead of
{
[...]
"exists" : true, "_source" : {
"user":"esuser",
"message":"esftw",
"postDate":"20111008"
}
}

What can I do?

Thx in advance

2

Correction:

It should return:

{
[...]
"exists" : true, "_source" : {
"user":"esuser",
"message":"esrulz",
"postDate":"20111008"
}
}

3

You have to request the current document first .. change the fields
and send it back to ES. it isn't possible to change one or more fields
directly.

Regards
Stefan

On Sun, Aug 21, 2011 at 4:42 PM, Frifri henning.frieder@googlemail.com wrote:

Correction:

It should return:

{
[...]
"exists" : true, "_source" : {
"user":"esuser",
"message":"esrulz",
"postDate":"20111008"
}
}

4

Alright, thx so far.

In my case, I want to add some additional tags (like comments etc) to an
indexed PDF (type attachment).

Example: PDF A, Comment B, preferably same id in the same mapping. If
somebody searches for a string which is part of both the content stream A
and the comment B, I'd like ES to return only one result as there is only
one id. If I use the same id in different mappings, I would have to merge
the two results, which is too much overhead in big deployments.

Should I use nested type (as described here:
http://www.elasticsearch.org/guide/reference/mapping/nested-type.html) or a
parent/child configuration?

Regards

5

Nested still requires working with the full document, as nested objects are
part of the json document you index (and thats the reason why "joining" on
them is so fast). Parent child is one way to go, where comments can be
children to the parent PDF doc.

On Sun, Aug 21, 2011 at 10:08 PM, Frifri henning.frieder@googlemail.comwrote:

Alright, thx so far.

In my case, I want to add some additional tags (like comments etc) to an
indexed PDF (type attachment).

Example: PDF A, Comment B, preferably same id in the same mapping. If
somebody searches for a string which is part of both the content stream A
and the comment B, I'd like ES to return only one result as there is only
one id. If I use the same id in different mappings, I would have to merge
the two results, which is too much overhead in big deployments.

Should I use nested type (as described here:
Elasticsearch Platform — Find real-time answers at scale | Elastic) or
a parent/child configuration?

Regards