Replace string by another in a field

Hello,

On Kibana 6.8.12
I want to replace a string in a field by another string.
This string to replace appears many times.
I want make this query 5 times for the 5 changes :

1

But i have this result with the query (my index is renamed in the screenshot) :

Where is my error ?

Thanks

What is the data type of master_ticket in the index mapping? I ask in case that master_ticket is actually text, keyword or a long.
Plus your query looks backwards If you want to replace the 2.02E+15 with "Not Identified" perhaps it should look something like.

POST my-index-000001/_update_by_query
{
  "script": {
    "source": "ctx._source.master_ticket = 'Not Identified'",
    "lang": "painless"
  },
  "query": {
    "term": {
      "master_ticket.keyword": "2.02E+15"
    }
  }
}

Hello,

In the mapping, "master_ticket is a keyword.

your query works if i deletel ".keyword" :slight_smile:

POST xxxxxxxxxxxxxx/_update_by_query
{
  "script": {
    "source": "ctx._source.master_ticket = 'Not Identified'",
    "lang": "painless"
  },
  "query": {
    "term": {
      "master_ticket": "2.02E+15"
    }
  }
} 

Thanks !

1 Like