在现有索引中创建一个新字段 - ElasticSearch

Question

I am wanting to create a new field and add it to an existing index so that way I can send a unique value to that new field. I was hoping there was an API to do this without having to do it in the CLI of Kibana. But I ran into this article that tells you how to add new fields to an existing index.

I tried to add it under _source field but it did not allow me.

PUT customer-simulation-es-app-logs-development-2021-07/_mapping
{
  "_source":{
    "TransactionKey":{
      "type": "keyword"
    }
  }
}

So I then added it to properties which allowed me:

PUT customer-simulation-es-app-logs-development-2021-07/_mapping
{
  "properties":{
    "TransactionKey":{
      "type": "keyword"
    }
  }
}

To make sure it was updated I ran the cmd GET customer-simulation-es-app-logs-development-2021-07/_mapping which did return it.

{
  "customer-simulation-es-app-logs-development-2021-07" : {
    "mappings" : {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "TransactionKey" : {
          "type" : "keyword"
        },
        "exceptions" : {
          "properties" : {
            "ClassName" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
.....

But when I go to Discover and type in TransactionKey for the fields nothing pops up. Did I not add the new field correctly to the existing index?

Answer 1

If you're running a version prior to 7.11, then you need to go to Stack Management > Index pattern and refresh your index pattern before seeing your new field in the Discover view. You need to do this every time your index mapping changes.

Since 7.11, the index pattern are being refreshed automatically whenever needed.