# \_update\_by\_query updates 3000 records instead of excpected 1

**URL:** <https://discuss.elastic.co/t/update-by-query-updates-3000-records-instead-of-excpected-1/190554>\
**Category:** Elasticsearch\
**Created:** [July 15, 2019, 2:01pm UTC](https://discuss.elastic.co/t/update-by-query-updates-3000-records-instead-of-excpected-1/190554 "2019-07-15T14:01:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jobra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jobra/32/50163_2.png) [@jobra](https://discuss.elastic.co/u/jobra)\
**Post date:** [July 15, 2019, 2:01pm UTC](https://discuss.elastic.co/t/update-by-query-updates-3000-records-instead-of-excpected-1/190554/1 "2019-07-15T14:01:00Z")

</div>

Hello,

In my elastic db I have one, and only one, json document where a "comment" field equals to  
".Stream ID:0. IP Data.somename.some.name some name:00."

I am running v. 6.6.2

Running the following \_update\_by\_query using **curl** , changes the field "comment" in 3000 documents, instead of the single wanted document.

`curl -X POST "https://localhost:9243/mydoc/_update_by_query" -u user:pass -o out.json -H 'Content-Type: application/json' -d'@data.json'`

In data.json  
{  
"script": {  
"source": "ctx.\_source.file\_path = 'C:\\test'",  
"lang": "painless"  
},  
"query": {  
"bool": {  
"should": [  
{ "match": { "comment":".Stream ID:0. IP Data.somename.some.name some name:00." }}  
]  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 12, 2019, 2:01pm UTC](https://discuss.elastic.co/t/update-by-query-updates-3000-records-instead-of-excpected-1/190554/2 "2019-08-12T14:01:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.