Hello I currently have in my elasticsearch index
"type": "NGINX",
how can I change it from
"type": "NGINX",
to
"type": "x",
in the current index.
Hello I currently have in my elasticsearch index
"type": "NGINX",
how can I change it from
"type": "NGINX",
to
"type": "x",
in the current index.
Types are going to be removed entirely anyway. So that should not really be a concern. Why do you want to change that?
If you want to do it, you need to reindex.
I am up for any suggestions. If you can please point me in the correct direction that would be much appreciated.
Also what do you mean "Types are going to be removed entirely"
@dadoonet
attached is a picture the field "Type" which i want to change it from NGINX to X
Hi,
What about update by query :
https://www.elastic.co/guide/en/elasticsearch/reference/7.0/docs-update-by-query.html
something like:
POST my_index/_update_by_query
{
"script": {
"source": "ctx._source.type='X'",
"lang": "painless"
},
"query": {
"term": {
"type": "NGINX"
}
}
}
Also it's better to not call your field type as it can confuse with _type meta field and depends on the language you use it can be a reserved word like in python.
lol. I have been confused by that name apparently
Thank you for the quick reply!
I tried running that (changed the "my_index/" to one of my indexes".
Got the following output.
{
"took" : 4,
"timed_out" : false,
"total" : 0,
"updated" : 0,
"deleted" : 0,
"batches" : 0,
"version_conflicts" : 0,
"noops" : 0,
"retries" : {
"bulk" : 0,
"search" : 0
},
"throttled_millis" : 0,
"requests_per_second" : -1.0,
"throttled_until_millis" : 0,
"failures" : [ ]
}
Any suggestions? I feel like I am missing something dumb here.
Fixed it!!!!!
POST logstash-*/_update_by_query
{
"script": {
"source": "ctx._source.type='x'",
"lang": "painless"
},
"query": {
"term": {
"type.keyword": "NGINX"
}
}
}
output
{
"took" : 4465,
"timed_out" : false,
"total" : 27808,
"updated" : 27808,
"deleted" : 0,
"batches" : 28,
"version_conflicts" : 0,
"noops" : 0,
"retries" : {
"bulk" : 0,
"search" : 0
},
"throttled_millis" : 0,
"requests_per_second" : -1.0,
"throttled_until_millis" : 0,
"failures" :
}
Hi,
According to the name of your index, if what you do is not a one time update maybe it's better to make the change directly in logstash to transform your data before indexing them or check about ingest for this.
https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html
You can set a default pipeline on the template so each time a new index "logstash-*" is created it will assign the pipeline.
I don't find the documentation
And in your pipeline definition you'll replace the "type" value if it's NGINX by X.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.