# Replace string by another in a field

**URL:** <https://discuss.elastic.co/t/replace-string-by-another-in-a-field/247780>\
**Category:** Kibana\
**Tags:** painless\
**Created:** [September 7, 2020, 1:29pm UTC](https://discuss.elastic.co/t/replace-string-by-another-in-a-field/247780 "2020-09-07T13:29:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fred59](https://avatars.discourse-cdn.com/v4/letter/f/50afbb/32.png) [@Fred59](https://discuss.elastic.co/u/Fred59)\
**Post date:** [September 7, 2020, 1:29pm UTC](https://discuss.elastic.co/t/replace-string-by-another-in-a-field/247780/1 "2020-09-07T13:29:20Z")

</div>

Hello,

On Kibana 6.8.12  
I want to replace a string in a field by another string.  
This string to replace appears many times.  
I want make this query 5 times for the 5 changes :

![1](https://us1.discourse-cdn.com/elastic/original/3X/4/1/416c268e981c9df05ef15742e1bb79b5e3ad4b6a.png)

But i have this result with the query (my index is renamed in the screenshot) :

 ![2](https://us1.discourse-cdn.com/elastic/original/3X/5/3/5324e0ec8f4e098db310845c4ff2bb5ace266e76.png)

Where is my error ?

Thanks

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [September 8, 2020, 1:34am UTC](https://discuss.elastic.co/t/replace-string-by-another-in-a-field/247780/2 "2020-09-08T01:34:57Z")

</div>

What is the data type of `master_ticket` in the index mapping? I ask in case that `master_ticket` is actually text, keyword or a long.  
Plus your query looks backwards If you want to replace the 2.02E+15 with "Not Identified" perhaps it should look something like.

```
POST my-index-000001/_update_by_query
{
  "script": {
    "source": "ctx._source.master_ticket = 'Not Identified'",
    "lang": "painless"
  },
  "query": {
    "term": {
      "master_ticket.keyword": "2.02E+15"
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![Fred59](https://avatars.discourse-cdn.com/v4/letter/f/50afbb/32.png) [@Fred59](https://discuss.elastic.co/u/Fred59)\
**Post date:** [September 8, 2020, 6:46am UTC](https://discuss.elastic.co/t/replace-string-by-another-in-a-field/247780/3 "2020-09-08T06:46:37Z")

</div>

Hello,

In the mapping, "master\_ticket is a keyword.

your query works if i deletel ".keyword" 🙂

```
POST xxxxxxxxxxxxxx/_update_by_query
{
  "script": {
    "source": "ctx._source.master_ticket = 'Not Identified'",
    "lang": "painless"
  },
  "query": {
    "term": {
      "master_ticket": "2.02E+15"
    }
  }
} 

```

Thanks !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 6, 2020, 6:46am UTC](https://discuss.elastic.co/t/replace-string-by-another-in-a-field/247780/4 "2020-10-06T06:46:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.