Update a field of document using DSL query

Question

I am working on generating logs and then from those logs generating an index. I have generated an index from the logs but now I need to modify a field of all the documents having that field.

Technically there is a field in my document named as status which tells the status of the transaction, In my logstash configuration file I have given a status "Transaction posted on POS" but now I want to change that to "Transaction completed on POS"

It's more like a find and replace query, any idea how can I achieve this using DSL query?

i don't know about logstash but in Graylog 2 you can simply search for anything including statuses without config changes.. — boateng
– boateng, Commented Dec 5, 2017 at 6:02
Thanks for the suggestion. But I need a solution for elasticsearch — Saram Ali Azhar
– Saram Ali Azhar, Commented Dec 5, 2017 at 6:03

Tim · Accepted Answer · 2017-12-05 08:16:20Z

1

This sounds like something you could do with the update by query API.

You call that API with an Elasticsearch query to pick which documents to update (which can simply be a match-all if you want to update all documents) and a Painless script that actually changes the data in those documents.

answered Dec 5, 2017 at 8:16

Tim

6,51924 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Update a field of document using DSL query

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related