Hi All. ,
I am not an expert in Elasticsearch, hence forgive me if this question is very silly . I am trying to update a record in. elastic search but unable to achieve the goal. .
Elastic Version. : 6.6. *
Requirement :- To update the field value.
Field name :- Source
Current Value. :- %{[beat][hostname]}"
New Value. :- LMSS_APP_LOGIN
Update when matching condition
I tried following. :- but no luck.
curl -X POST "http://localhost:9200/graylog */ update_by_query" -H 'Content-Type: application/json' -d'
{
_ "script": {_
_ "inline":_
_ "ctx. source.data.oldValues.source=ctx. source.data.currentValues.source;
_ ctx. source.data.currentValues.source=params.newState.source;",
_ "params": {
_ "newState": {"source": "LMSS_APP_LOGIN" }_
_ }_
_ },_
_ "query": {_
_ "term": {_
_ "environment": "LMSS"_
_ }_
_ }_
}
'
}
Thrown following error.
{"error":{"root_cause":[{"type":"json_parse_exception","reason":"Illegal unquoted character ((CTRL-CHAR, code 10)): has to be escaped using backslash to be included in string value\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@4ffc89c7; line: 5, column: 79]"}],"type":"json_parse_exception","reason":"Illegal unquoted character ((CTRL-CHAR, code 10)): has to be escaped using backslash to be included in string value\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@4ffc89c7; line: 5, column: 79]"},"status":500}[root@rootlm01 scripts]#
[root@rootlm01 scripts]#