从 Elastic Search 的索引中删除现有字段

Question

I am a newbie in Elastic search. I have an unwanted field in my index say index name "test_index". This contains almost 155154 documents. I want to remove an unwanted field "B" from my index. This is how my index pattern look like in json format

{A: {B: {C: } }

I believe removing B will automatically remove C from my index as well. In order to do that, I used the following query but it didn't seem to work.

POST test_index/_update_by_query?conflicts=proceed {
      "script" : "ctx._source.A.remove('B')", 
       "query" : {
        "exists": { "field": "A.B" }
      }
} 

Please let me know where I am doing the mistake.

Thank you

Answer 1

Your syntax is correct. You get timeout since its running the process in the background and times out before completing the task .

You can run the query asynchronously by specifying wait_for_completion=false

POST test_index/_update_by_query?conflicts=proceed&wait_for_completion=false
{
      "script" : "ctx._source.A.remove('B')", 
       "query" : {
        "exists": { "field": "A.B" }
      }
} 

Above will give a response with taskId

{
  "task" : "{taskId:node}"
}

Now you can use task api to get the status of the task using the value from above

GET _tasks/{taskId:node}

Alternatively, if you dont specify wait_for_completion=false and get a time out, you can still get all tasks by actions like below. But, i'd recommend do the first one.

GET _tasks?actions=*byquery&detailed.

From comments: Now say if I have 100 index having a similar name pattern for example an index having a name "test_date - MM/DD/YYYY" here the prefix is same "test"

In order to handle multiple indices, you can use the wild card syntax and replace index name with prefix and *

For example, below query will run on all indices that start with test :

POST test*/_update_by_query?conflicts=proceed&wait_for_completion=false
{
      "script" : "ctx._source.A.remove('B')", 
       "query" : {
        "exists": { "field": "A.B" }
      }
}