Elastic search how to add new field and put value from existing field

Question

I have a elastic search index as follows,

 {
  "payment_transaction": {
    "mappings": {
      "message_logs": {
        "properties": {
          "@timestamp": {
            "type": "date"
          },
          "changed_date": {
            "type": "date"
          },
          "created_date": {
            "type": "date"
          }
        }
      }
    }
  }
}

And I need to add another three fields(year,month,day).And need to assign values from the existing field (created_date). The format of the created_date is 2016-11-22T22:20:21.000Z. How can i do this ? Elastic search version is 5.0.

Answer 1

A work around is to copy created_date field to separate text fields using copy_to option of mapping. The text fields can then be analyzed to extract the year, month day using the pattern_replace char filter as shown in the example below:

Example:

put test 
{
    "settings": {
        "analysis": {
            "char_filter": {
                "year" : {
                    "type": "pattern_replace",
                    "pattern": "(\\d{4})-(\\d{2})-(\\d{2})T\\d{2}:\\d{2}:\\d{2}.\\d{3}Z",
                    "replacement": "$1"
                },
                "month" : {
                    "type": "pattern_replace",
                    "pattern": "(\\d{4})-(\\d{2})-(\\d{2})T\\d{2}:\\d{2}:\\d{2}.\\d{3}Z",
                    "replacement": "$2"
                },
                "day" : {
                    "type": "pattern_replace",
                       "pattern": "(\\d{4})-(\\d{2})-(\\d{2})T\\d{2}:\\d{2}:\\d{2}.\\d{3}Z",
                    "replacement": "$3"
                }
            },
            "analyzer": {
                "year" : {

                    "tokenizer" : "keyword",
                    "char_filter" : ["year"]
                },
                "month" : {

                    "tokenizer" : "keyword",
                    "char_filter" : ["month"]
                },
                "day" : {

                    "tokenizer" : "keyword",
                    "char_filter" : ["day"]
                }

            }
        }
    }
}
put test/message_logs/_mapping
{


      "message_logs": {
        "properties": {
          "@timestamp": {
            "type": "date"
          },
          "changed_date": {
            "type": "date"
          },
          "created_date": {
            "type": "date",

            "copy_to" : ["year","month","day"]
          },
           "year": {
            "type": "text",
            "analyzer" : "year",
            "search_analyzer":"keyword",
            "store" : true,
            "fielddata":true


          },
          "month": {
                 "type": "text",
            "analyzer" : "month",
            "search_analyzer":"keyword",
            "store" : true,
            "fielddata":true


          },
          "day": {
               "type": "text",
            "analyzer" : "day",
            "search_analyzer":"keyword",
            "store" : true,
            "fielddata":true


          }
        }
      }


}

put test/message_logs/1 
{
    "created_date" : "2016-11-22T22:20:21.000Z"
}

post test/message_logs/_search
{
    "fielddata_fields": [
       "year",
       "month",
       "day"
    ]
}

Result:

    {
   "took": 3,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 1,
      "max_score": 1,
      "hits": [
         {
            "_index": "test",
            "_type": "message_logs",
            "_id": "1",
            "_score": 1,
            "_source": {
               "created_date": "2016-11-22T22:20:21.000Z"
            },
            "fields": {
               "month": [
                  "11"
               ],
               "year": [
                  "2016"
               ],
               "day": [
                  "22"
               ]
            }
         }
      ]
   }
}

The fielddata need not be true and is enabled only for purpose of the example.