Trying to change a fields name

Elastic Stack Elasticsearch
1

Hello I currently have in my elasticsearch index

"type": "NGINX",

how can I change it from

"type": "NGINX",
to
"type": "x",

in the current index.

2

Types are going to be removed entirely anyway. So that should not really be a concern. Why do you want to change that?

If you want to do it, you need to reindex.

3

image
image.png812×94 4.59 KB

I am up for any suggestions. If you can please point me in the correct direction that would be much appreciated.

Also what do you mean "Types are going to be removed entirely"
@dadoonet

4

attached is a picture the field "Type" which i want to change it from NGINX to X

5

I meant https://www.elastic.co/blog/removal-of-mapping-types-elasticsearch

6

Hi,

What about update by query :

https://www.elastic.co/guide/en/elasticsearch/reference/7.0/docs-update-by-query.html

something like:

POST my_index/_update_by_query
{
  "script": {
    "source": "ctx._source.type='X'",
    "lang": "painless"
  },
  "query": {
    "term": {
      "type": "NGINX"
    }
  }
}

Also it's better to not call your field type as it can confuse with _type meta field and depends on the language you use it can be a reserved word like in python.

7

lol. I have been confused by that name apparently :joy:

8

@dadoonet @gabriel_tessier

Thank you for the quick reply!

I tried running that (changed the "my_index/" to one of my indexes".

Got the following output.

 {
  "took" : 4,
  "timed_out" : false,
  "total" : 0,
  "updated" : 0,
  "deleted" : 0,
  "batches" : 0,
  "version_conflicts" : 0,
  "noops" : 0,
  "retries" : {
    "bulk" : 0,
    "search" : 0
  },
  "throttled_millis" : 0,
  "requests_per_second" : -1.0,
  "throttled_until_millis" : 0,
  "failures" : [ ]
}

Any suggestions? I feel like I am missing something dumb here.

9

Fixed it!!!!!

POST logstash-*/_update_by_query
{
  "script": {
    "source": "ctx._source.type='x'",
    "lang": "painless"
  },
  "query": {
    "term": {
      "type.keyword": "NGINX"
    }
  }
}

output
{
"took" : 4465,
"timed_out" : false,
"total" : 27808,
"updated" : 27808,
"deleted" : 0,
"batches" : 28,
"version_conflicts" : 0,
"noops" : 0,
"retries" : {
"bulk" : 0,
"search" : 0
},
"throttled_millis" : 0,
"requests_per_second" : -1.0,
"throttled_until_millis" : 0,
"failures" :
}

10

Hi,

According to the name of your index, if what you do is not a one time update maybe it's better to make the change directly in logstash to transform your data before indexing them or check about ingest for this.

https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html

You can set a default pipeline on the template so each time a new index "logstash-*" is created it will assign the pipeline.

I don't find the documentation :sweat:

And in your pipeline definition you'll replace the "type" value if it's NGINX by X.

https://www.elastic.co/guide/en/elasticsearch/reference/current/conditionals-with-multiple-pipelines.html