Update value in elastic

[elasticforme (Sachin)]

I want to write a query and update a field, my index already has all of listed field
para, mytime, yourtime, someonestime

by this logic

if [para="T'] {
mytime=yourtime
}
else
{
mytime=someonestime
}

is this possible in elastic ?

[dadoonet (David Pilato)]

Update by query with a painless script will probably be the thing you want.

[elasticforme (Sachin)]

@dadoonet
any example. I was just reading it but so confuse to get my head around it

[dadoonet (David Pilato)]

There is one example here: https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-update-by-query.html

[elasticforme (Sachin)]

Is this looks right?
if yes how do I execute this. getting more confuse.

if (doc['para'].value = "T") {
doc['mytime'].value = doc['yourtime'].value;
}
else {
doc['mytime'].value = doc['someonestime'].value;
}

[elasticforme (Sachin)]

I try this but didn't work

POST resources-2019/_update_by_query
{
  "script":{
    "lang": "painless",
    "inline": "if (ctx._source.para = 'T') {
      ctx._source.mytime = ctx._source.yourtime }"
  }
}

Illegal unquoted character ((CTRL-CHAR, code 10)): has to be escaped using backslash to be included in string value\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@4b5fac4; line: 4, column: 46]"

try T without quote, double quote same error

[dadoonet (David Pilato)]

I think that may be this should be fixed:

if (ctx._source.para = 'T')

With

if (ctx._source.para == \"T\")

I'm not a Painless user so that's just a guess.

[elasticforme (Sachin)]

doing it testing as listed somewhere on site
created a record
{
"_index" : "stocks",
"_type" : "mystocks",
"_id" : "1",
"_score" : 1.0,
"_source" : {
"company" : "Apple",
"symbol" : "aapl",
"shares" : 100,
"price" : 150,
"purchase_date" : "2017/07/25",
"risk" : "moderate"
}

POST /stocks/mystocks/_update_by_query?pretty
{
  "script": {
    "lang":"painless",
   "inline": "if (ctx._source.symbol = \"aapl\") { ctx._source.risk =\"LOW\" } else {ctx.op='noop'}"
  }
}

Give me following error
{
"error": {
"root_cause": [
{
"type": "script_exception",
"reason": "compile error",
"script_stack": [
"if (ctx._source.symbol = "aap ...",
" ^---- HERE"
],
"script": "if (ctx._source.symbol = "aapl") { ctx._source.risk ="LOW" } else {ctx.op='noop'}",
"lang": "painless"
}
],
"type": "script_exception",
"reason": "compile error",
"script_stack": [
"if (ctx._source.symbol = "aap ...",
" ^---- HERE"
],
"script": "if (ctx._source.symbol = "aapl") { ctx._source.risk ="LOW" } else {ctx.op='noop'}",
"lang": "painless",
"caused_by": {
"type": "class_cast_exception",
"reason": "Cannot cast from [java.lang.String] to [boolean]."
}
},
"status": 400
}

[dadoonet (David Pilato)]

Try with == as I mentioned before.

[elasticforme (Sachin)]

Perefect this syntax worked
POST /stocks/mystocks/_update_by_query?pretty
{
"script": {
"lang":"painless",
"inline": "if (ctx._source.symbol == "aapl") { ctx._source.risk = "Low" } else {ctx.op='noop'}"
}
}

[elasticforme (Sachin)]

infact all other combination works

    POST /stocks/mystocks/_update_by_query?pretty
{
  "script": {
    "lang":"painless",
   "inline": "if (ctx._source.symbol == \"aapl\") { ctx._source.shares = ctx._source.price } else {ctx.op='noop'}"
  }
}

and this as well

POST /stocks/mystocks/_update_by_query?pretty
{
  "script": {
    "lang":"painless",
   "inline": "if (ctx._source.shares == 150) { ctx._source.price = ctx._source.shares } else {ctx.op='noop'}"
  }
}