Update elastic search doc field value for specific fields in all documents

Question

I have documents like this.

{
"a":"test",
"b":"harry"
},
{
"a":""
"b":"jack"
}

I need to update docs with field a=="" (empty string) to default value say null in all documents for a given index. Any help is appreciated. Thanks

Answer 1

Use Update by query with ingest

_update_by_query can also use the Ingest Node feature by specifying a pipeline like this:

define the pipeline

PUT _ingest/pipeline/set-foo
{
  "description" : "sets foo",
  "processors" : [ {
      "set" : {
        "field": "a",
        "value": null
      }
  } ]
}

then you can use it like:

 POST myindex/_update_by_query?pipeline=set-foo
{
 "query": {
   "filtered": {
     "filter": {
       "script": {
         "script": "_source._content.length() == 0"
       }
     }
   }
 }
}'

OR

    POST myindex/_update_by_query?pipeline=set-foo
    {
        "query": {
            "bool" : {
                "must" : {
                    "script" : {
                        "script" : {
                            "inline": "doc['a'].empty",
                            "lang": "painless"
                         }
                    }
                }
            }
        }
    }

Answer 2

To query a documents with empty string field value, ie = ''
I did,

"query": {
  "bool": {
    "must": [
      {
        "exists": {
          "field": "a"
        }
      }
    ],
    "must_not": [
      {
        "wildcard": {
          "a": "*"
        }
      }
      ]
    }
  }

So overall query to update all docs with field a=="" is,

POST test11/_update_by_query
{
  "script": {
    "inline": "ctx._source.a=null",
    "lang": "painless"
  },
  "query": {
    "bool": {
      "must": [
        {
          "exists": {
            "field": "a"
          }
        }
      ],
      "must_not": [
        {
          "wildcard": {
            "a": "*"
          }
        }
      ]
    }
  }
}