Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Elasticsearch Mapping - Rename existing field

Is there anyway I can rename an element in an existing elasticsearch mapping without having to add a new element ? If so whats the best way to do it in order to avoid breaking the existing mapping?

e.g. from fieldCamelcase to fieldCamelCase

{
    "myType": {
        "properties": {
            "timestamp": {
                "type": "date",
                "format": "date_optional_time"
            },
            "fieldCamelcase": {
                "type": "string",
                "index": "not_analyzed"
            },
            "field_test": {
                "type": "double"
            }
        }
    }
}
like image 677
e.f.a. Avatar asked Mar 30 '17 14:03

e.f.a.


People also ask

Can we update mapping in Elasticsearch?

It is not possible to update the mapping of an existing field. If the mapping is set to the wrong type, re-creating the index with updated mapping and re-indexing is the only option available. In version 7.0, Elasticsearch has deprecated the document type and the default document type is set to _doc.

How do I rename a field in Kibana?

You cannot rename fields, but it is possible is some cases to create a scripted field (configured under the Index Pattern) which serves as an alias of the original field. Note, that scripted fields are not available in Timelion or Visual Builder.

How do I rename an index in Elasticsearch?

Starting with ElasticSearch 7.4, the best method to rename an index is to copy the index using the newly introduced Clone Index API, then to delete the original index using the Delete Index API.


2 Answers

First of all, you must understand how elasticsearch and lucene store data, by immutable segments (you can read about easily on Internet).

So, any solution will remove/create documents and change mapping or create a new index so a new mapping as well.

The easiest way is to use the update by query API: https://www.elastic.co/guide/en/elasticsearch/reference/2.4/docs-update-by-query.html

POST /XXXX/_update_by_query

{
    "query": { 
    "missing": {
      "field": "fieldCamelCase"
    }
  },
    "script" : {
        "inline": "ctx._source.fieldCamelCase = ctx._source.fieldCamelcase; ctx._source.remove(\"fieldCamelcase\");"
    }
}
like image 154
Thomas Decaux Avatar answered Sep 20 '22 12:09

Thomas Decaux


You could do this by creating an Ingest pipeline, that contains a Rename Processor in combination with the Reindex API.

PUT _ingest/pipeline/my_rename_pipeline
{
  "description" : "describe pipeline",
  "processors" : [
    {
      "rename": {
        "field": "fieldCamelcase",
        "target_field": "fieldCamelCase"
      }
    }
  ]
}

POST _reindex
{
  "source": {
    "index": "source"
  },
  "dest": {
    "index": "dest",
    "pipeline": "my_rename_pipeline"
  }
} 

Note that you need to be running Elasticsearch 5.x in order to use ingest. If you're running < 5.x then you'll have to go with what @Val mentioned in his comment :)

like image 38
Byron Voorbach Avatar answered Sep 19 '22 12:09

Byron Voorbach