I was looking for a way to delete a tag from docs in an index and I found the following two discussions on github
I tried the suggestion in the first discussion:
And then I tried the suggestion in the second discussion:
But when I tried the syntax mentioned in that thread:
POST logstash-*/_update_by_query
{
"query" : {
"match" : { "tags": "GREEN" }
},
"script":{"inline":"ctx._source.tags.remove(ctx._source.field.indexOf(params.value))","lang":"painless","params": {"tag":"NEWTAG"}
}
}
I got the following error:
"type": "script_exception:,
"reason":"runtime error",
"script_stack": [
"ctx._source.tags.remove(ctx._source.field.indexOf(params.tag))",
" ^---- HERE"
],
"script":"ctx._source.tags.remove(ctx._source.field.indexOf(params.tag))",
"lang":"painless",
"caused_by": {
"type":"null_pointer_exception",
"reason": null
}
},
"status":500
}
I'm still looking, but I'm hoping someone has a suggestion about either my syntax for another method...
Or, I've also read that these errors can be caused by a single field NOT being an array, then the whole operation crashes. Is there a way to find that one (or few) fields?