Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Renaming fields in elasticsearch

I have a document like this

{
    "_index": "testindex",
    "_type": "logs",
    "_id": "1",
    "_score": 1,
    "_source": {
      "field1": "data1",
      "field2": "data2"
    }
}

I need to change the field2 to Request.field3

{
    "_index": "testindex",
    "_type": "logs",
    "_id": "1",
    "_score": 1,
    "_source": {
      "field1": "data1",
      "Request": {
        "field3": "data2"
      }
    }
}

For this, first added a field mapping to existing index

PUT testindex/_mapping/logs
{
    "properties": 
    { 
        "Request": 
        {
            "properties": 
            {
                "field3" : 
                {
                    "type": "string"
                }
            }
        }   
    }  
}

Then tried reindexing

POST _reindex
{
    "source": {
        "index": "testindex"
    },
    "dest": {
        "index": "testindex1"
    },
    "script": {
        "inline": "ctx._source.Request.field3 = ctx._source.remove(\"field2\")"
    }
}

Error is

"reason": "failed to run inline script [ctx._source.Request.field3 = ctx._source.remove(\"field2\")] using lang [groovy]",
"caused_by": {
    "type": "null_pointer_exception",
    "reason": "Cannot set property 'field3' on null object"
}
like image 297
seba_sencha Avatar asked Nov 15 '16 10:11

seba_sencha


People also ask

How do you rename a field in ACL?

To rename a field in a table in Access, open the table containing the field to rename in design view. Then click into the “Field Name” column of the field that to rename and type a new name.

How do I rename a field in Kibana?

You cannot rename fields, but it is possible is some cases to create a scripted field (configured under the Index Pattern) which serves as an alias of the original field.

How do I rename an index in ElasticSearch?

Starting with ElasticSearch 7.4, the best method to rename an index is to copy the index using the newly introduced Clone Index API, then to delete the original index using the Delete Index API.


2 Answers

The Request field does not yet exist in your documents, so your script needs to create it first:

POST _reindex
{
    "source": {
        "index": "testindex"
    },
    "dest": {
        "index": "testindex1"
    },
    "script": {
        "inline": "ctx._source.Request = [:]; ctx._source.Request.field3 = ctx._source.remove(\"field2\") ]"
    }
}

Or a bit shorter like this:

POST _reindex
{
    "source": {
        "index": "testindex"
    },
    "dest": {
        "index": "testindex1"
    },
    "script": {
        "inline": "ctx._source.Request = [field3: ctx._source.remove(\"field2\") ]"
    }
}
like image 123
Val Avatar answered Sep 30 '22 05:09

Val


The easiest way to rename the field name is to use the _update_by_query API:

Example: POST http://localhost:9200/INDEX_NAME/_update_by_query

{
  "query": { 
    "bool": {
        "must_not": {
            "exists": {
                "field": "NEW_FIELD_NAME"
            }
        }
    }
  },
  "script" : {
    "inline": "ctx._source.NEW_FIELD_NAME = ctx._source.OLD_FIELD_NAME; ctx._source.remove(\"OLD_FIELD_NAME\");"
  }
}
like image 43
Pramod H G Avatar answered Sep 30 '22 06:09

Pramod H G