Search and replace in all my documents

Elastic Stack Elasticsearch
1

hi,

i want to replace an ip with a hostname.
how can i do this in all my documents with a particual field "hostname"?
i prefer to use head plugin and get the code from you.

any help is greatly appreciated,
docmax

2

You can't currently update by a query condition. IE You can't currently "UPDATE WHERE" to compare to SQL

Instead, what I tend to do is search for the condition, and use the scan and scroll API then a bulk update. This is usually fine with a relatively static index. If your documents change between reading and updating you could experience conflicts. You'll have to figure out if this is a problem for your use case.