Elasticsearch - 以任何方式找出所有字段值为文本的文档

Question

In the elasticsearch cluster, I accidentally pushed some text in a field which should ideally be a Number. Later, I fixed that and pushed the Number type value. Now, I wanted to fix it such that all the old values can be replaced by some Number for which I need to find out all the documents which are having this field as text.

Is there any elasticsearch query that I can use to get this information?

Answer 1

I think that can be possible by using a nested aggregations .

At the top-level; use terms aggregation to know text values, at the sub-level; use top_hits aggregation to get documents that includes these values.

for instance:

GET example_index/_search
{
  "size": 0,
  "aggs": {
    "NAME": {
      "terms": {
        "field": "example_field.keyword",
        "size": 10
      },
      "aggs": {
        "documents": {
          "top_hits": {
            "size": 10
          }
        }
      }
    }
  }
}

This query; will return distinct values of the field, and the related documents in the sub-level, something like:

{
  "aggregations": {
    "NAME": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "mistake",
          "doc_count": 2,
          "documents": {
            "hits": {
              "total": 2,
              "max_score": 1,
              "hits": [
                {
                  "_index": "example_index",
                  "_type": "example_index",
                  "_id": "2QoDoXEBOCkJkkpwq5P0",
                  "_score": 1,
                  "_source": {
                    "example_field": "mistake"
                  }
                },
                {
                  "_index": "example_index",
                  "_type": "example_index",
                  "_id": "qAoDoXEBOCkJkkpwq5T0",
                  "_score": 1,
                  "_source": {
                    "example_field": "mistake"
                  }
                }
              ]
            }
          }
        },
        {
          "key": "520",
          "doc_count": 2,
          "documents": {
            "hits": {
              "total": 1,
              "max_score": 1,
              "hits": [
                {
                  "_index": "example_index",
                  "_type": "example_index",
                  "_id": "5goDoXEBOCkJkkpwq5P0",
                  "_score": 1,
                  "_source": {
                    "example_field": "1"
                  }
                }
              ]
            }
          }
        }
      ]
    }
  }
}

I the example above; we need to delete the documents with mistake value, you can simply delete them by id.

NOTE: if you have a big index, it's rather to write a function inside your code that builds aggregations, gets the response, filters values if it can be parsed to a number, then removes documents by id.