elasticsearch kibana更新文档，该空间使用按查询更新具有空间

Question

I have a field to update which has space in it.

POST /index/type/_update_by_query
{
  "query": {
      "match_phrase":{
        "field": "value"
      }
  },
  "script":{
    "lang": "painless",
    "inline": "ctx._source.Existing Field = New_Value"
  }
}

But I get this error.

{
  "error": {
    "root_cause": [
      {
        "type": "script_exception",
        "reason": "compile error",
        "script_stack": [
          "ctx._source.Existing Field = New_Value",
          "                     ^---- HERE"
        ],
        "script": "ctx._source.Existing Field = New_Value",
        "lang": "painless"
      }
    ],
    "type": "script_exception",
    "reason": "compile error",
    "script_stack": [
      "ctx._source.Existing Field = New_Value",
      "                     ^---- HERE"
    ],
    "script": "ctx._source.Existing Field = New_Value",
    "lang": "painless",
    "caused_by": {
      "type": "illegal_argument_exception",
      "reason": "unexpected token ['Field'] was expecting one of [{<EOF>, ';'}]."
    }
  },
  "status": 500
}

When I execute this query on a field which doesn't have space, it works fine. How do I handle cases where there is a space in the field name?

ELK version = 5.4.3 I have read in the documentation that using spaces in field names is not advised, but these fields are dynamically created from a certain server and there are like 1M data entries every day. Hence I want to do a update_by_query on all the matching entries.

Answer 1

Try this one:

POST index/type/_update_by_query
{
  "script":{
    "lang": "painless",
    "inline": "ctx._source['Existing Field'] = 'New Value'"
  }
}

This is possible because ctx._source is an instance of painless Map , which is a normal Java HashMap . It allows you to access fields with weird characters and also add and remove fields in update queries.

Hope that helps!