简体   繁体   中英

Update by query with a clause in ElasticSearch

I have an elasticsearch index where some records have a @timestamp of 1st Feb. There is also a field in the _source called process_time which is different for each record with same @timestamp .

{
        "_index": "elasticsearch-index",
        "_type": "doc",
        "_id": "qByop2gBw60PM5VYP0aG",
        "_score": 1,
        "_source": {
          "task": "INFO",
          "@timestamp": "2019-02-01T06:04:08.365Z",
          "num_of_batches": 0,
          "batch_size": 1000,
          "process_time": "2019-02-04 06:04:04,489"
        }
},
{
        "_index": "elasticsearch-index",
        "_type": "doc",
        "_id": "qByop2gBw60PM5VYP0aG",
        "_score": 1,
        "_source": {
          "task": "INFO",
          "@timestamp": "2019-02-01T06:04:08.365Z",
          "num_of_batches": 0,
          "batch_size": 1000,
          "process_time": "2019-02-05 06:04:04,489"
        }
}

I want to update the @timestamp of all records having @timestamp as 1st Feb to whatever is the process_time in that record.

How can I do this?

EDIT:

After @mysterion's answer I did the following changes as below:

{
  "script": {
    "source": """ctx._source['@timestamp'] = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss.SSS").parse(ctx._source.process_time.replaceAll(",","."))""",
    "lang": "painless"
  },
  "query": {
    "term": {
      "@timestamp": "2019-02-01"
    }
  }
}

But I got the following exception:

"type": "class_cast_exception",
"reason": "Cannot cast java.lang.String to java.util.function.Function"

You could utilize Update by Query API to update needed documents in the Elasticsearch.

POST index_name/_update_by_query?conflicts=proceed
{
    “script”: {
        “source”: “ctx._source[‘@timestamp’] = new SimpleDateFormat(‘yyyy-MM-dd HH:mm:ss,SSS’).parse(ctx._source.process_time)”,
        “lang”: “painless”
    },
    “query”: {
        “term”: {
            “@timestamp”: “2019-01-01T00:00:00Z”
        }
    }
}

You're using replaceAll method expecting that it's a plain Java String method, in fact - it's not. It is

String replaceAll(Pattern, Function)

More information on Painless API reference - https://www.elastic.co/guide/en/elasticsearch/painless/current/painless-api-reference.html

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM