CODEWITHSUNDEEP
elasticsearch
Bhargav Nanekalva
Bhargav Nanekalva

Reputation: 616

How to update part of my document in Elasticsearch

I'm just getting started with Logstash and Elasticsearch.

See the code snippet below. In Elasticsearch I'm trying to update host value to Foo from Bhargav

What is the curl command I need to use to make this happen? Assuming I'm running Elasticsearch on localhost:9200.

{
  "took": 4,
  "timed_out": false,
  "_shards": {
    "total": 15,
    "successful": 15,
    "failed": 0
  },
  "hits": {
    "total": 8,
    "max_score": 1.0,
    "hits": [
      {
        "_index": "logstash-2011.05.18",
        "_type": "apache_access",
        "_id": "yyncoyOeTgij9awB13S4WQ",
        "_score": 1.0,
        "_source": {
          "message": "134.39.72.245 - - [18/May/2011:12:40:18 -0700] \"GET /favicon.ico HTTP/1.1\" 200 1189 \"-\" \"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; .NET4.0C; .NET4.0E)\"",
          "@version": "1",
          "@timestamp": "2011-05-18T19:40:18.000Z",
          "host": "Bhargav",
          "timestamp": "18/May/2011:12:40:18 -0700",
          "verb": "GET",
          "request": "/favicon.ico",
          "httpversion": "1.1",
          "response": "200",
          "bytes": "1189",
          "referrer": "\"-\"",
          "agent": "\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; .NET4.0C; .NET4.0E)\""
        }
      },
      {
        "_index": "logstash-2011.05.18",
        "_type": "apache_access",
        "_id": "sMcXwrmTQzaiWW-zUSE7MA",
        "_score": 1.0,
        "_source": {
          "message": "134.39.72.245 - - [18/May/2011:12:40:18 -0700] \"GET /favicon.ico HTTP/1.1\" 200 1189 \"-\" \"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; .NET4.0C; .NET4.0E)\"",
          "@version": "1",
          "@timestamp": "2011-05-18T19:40:18.000Z",
          "host": "Bhargav",
          "path": "/tmp/access_log",
          "type": "apache_access",
          "clientip": "134.39.72.245",
          "ident": "-",
          "auth": "-",
          "timestamp": "18/May/2011:12:40:18 -0700",
          "verb": "GET",
          "request": "/favicon.ico",
          "httpversion": "1.1",
          "response": "200",
          "bytes": "1189",
          "referrer": "\"-\"",
          "agent": "\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; .NET4.0C; .NET4.0E)\""
        }
      }
    ]
  }
}

Upvotes: 0

Views: 95

Answers (1)

Vineeth Mohan
Vineeth Mohan

Reputation: 19283

Here the only option would be to use partial update in UPDATE API

curl -XPOST 'localhost:9200/test/type1/1/_update' -d '{
    "doc" : {
        "host" : "Bhargav"
    }
}'

But then this can be only applied to a single document. There is a out of box for update by query , you can try that.

Upvotes: 1

Related Questions