Updating data fields

Elastic Stack Elasticsearch
1

Hello guys,

I want to update a field in elasticsearch but with a condition. In sql it would like something like this:

  • UPDATE table_name
    SET column1 = value1
    WHERE column1="blabla" and column1="bleble";

Can I do this in elasticsearch?

I suppose it is something like this but with the condition:

POST test/type1/
{
"tags" : ["red"]
}

Can you help me?

2

Update by query is what you are looking for

3

Something like this?

POST twitter/_update_by_query?conflicts=proceed
{
"query": {
"term": {
"user": "kimchy"
}
}
}

I can't fully understand what is being updated. What I can see here is that all the kimchy value in user field is going to be updated but to what?

Thanks for the help. And sorry if the questions are being very basic.

Best regards,
Afonso Ribeiro

4

All segments in Elasticsearch are immutable, so there are no in-place updates. The full documents will therefore be reindexed.

1 Like
5

Please format your code using </> icon as explained in this guide. It will make your post more readable.

Or use markdown style like:

```
CODE
```

What I can see here is that all the kimchy value in user field is going to be updated but to what?

No. You are just selected here all documents which are matching kimchy on the name field. You are here just reindexing them without changing anything in the _source.
This is used when you change the mapping and wants to add a sub field in the mapping. You have for that to reevaluate all the documents.

But you can add a script to transform the document:

  "script": {
    "source": "ctx._source.foo=1",
    "lang": "painless"
  },

Or define an ingest processor which will do the transformation:

PUT _ingest/pipeline/set-foo
{
  "description" : "sets foo",
  "processors" : [ {
      "set" : {
        "field": "foo",
        "value": "bar"
      }
  } ]
}
POST twitter/_update_by_query?pipeline=set-foo
1 Like
6

Ok. I will take a look at that.

Thank you very much

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.