Elasticsearch Delete Mapping Property

Question

I am trying to figure out an approach to delete all entries for a specific property in an elasticsearch index and remove all type mappings for that property.

I have been looking at the following two doc pages: put mapping and delete mapping

From second link:

"Allow to delete a mapping (type) along with its data. The REST endpoint is /{index}/{type} with DELETE method."

What I think I need is a /{index}/{type}/{property} ?

Do I need to recreate the whole index to accomplish this, ie moving and manipulating data between types?

For Example, calling GET on the mapping:

curl -XGET 'http://.../some_index/some_type/_mapping'

result:

{
  "some_type": {
    "properties": {
      "propVal1": {
        "type": "double",
        "index": "analyzed"
      },
      "propVal2": {
        "type": "string",
        "analyzer": "keyword"
      },
      "propVal3": {
        "type": "string",
        "analyzer": "keyword"
      }
    }
  }
}

after this delete operation on propVal3 would return:

curl -XGET 'http://.../some_index/some_type/_mapping'

result:

{
  "some_type": {
    "properties": {
      "propVal1": {
        "type": "double",
        "index": "analyzed"
      },
      "propVal2": {
        "type": "string",
        "analyzer": "keyword"
      }
    }
  }
}

and all data for propVal3 would be removed through the index.

Answer 1

You can not do that. Just forget that this value exists... ;-) If you really need to remove it, you will have to reindex your documents.

Answer 2

You can use the new _reindex api for this, you could even PUT a new _mapping to the dest index before running the reindex so you can change the properties of the fields in your index.

To do a reindex and removing a property, you can do this:

POST /_reindex
{
  "source": {
    "index": "twitter"
  },
  "dest": {
    "index": "new_twitter",
  },
  "script": {
    "inline": "ctx._source.remove('whatever')"
  }
}

if you would use this in combination with the _aliases API you can modify indexes without having any 'downtime'

Answer 3

It's not currently possible to remove a property from a mapping. In order to remove all values of a property from all records, you need to reindex all records with this property removed.

Answer 4

You can choose whats documents fields you will reindex to a new index. For example:

POST _reindex { "source": { "index": "my-source-index", "_source": ["host.hostname", "host.ip", "another_field"] }, "dest": { "index": "my-dest-index" } }

Reference: https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html#docs-reindex-filter-source