CODEWITHSUNDEEP
elasticsearchkibana
MarkCo
MarkCo

Reputation: 1222

Creating a new field into existing index - ElasticSearch

I am wanting to create a new field and add it to an existing index so that way I can send a unique value to that new field. I was hoping there was an API to do this without having to do it in the CLI of Kibana. But I ran into this article that tells you how to add new fields to an existing index.

I tried to add it under _source field but it did not allow me.

PUT customer-simulation-es-app-logs-development-2021-07/_mapping
{
  "_source":{
    "TransactionKey":{
      "type": "keyword"
    }
  }
}

So I then added it to properties which allowed me:

PUT customer-simulation-es-app-logs-development-2021-07/_mapping
{
  "properties":{
    "TransactionKey":{
      "type": "keyword"
    }
  }
}

To make sure it was updated I ran the cmd GET customer-simulation-es-app-logs-development-2021-07/_mapping which did return it.

{
  "customer-simulation-es-app-logs-development-2021-07" : {
    "mappings" : {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "TransactionKey" : {
          "type" : "keyword"
        },
        "exceptions" : {
          "properties" : {
            "ClassName" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
.....

But when I go to Discover and type in TransactionKey for the fields nothing pops up. Did I not add the new field correctly to the existing index?

Upvotes: 0

Views: 4635

Answers (1)

Val
Val

Reputation: 217554

If you're running a version prior to 7.11, then you need to go to Stack Management > Index pattern and refresh your index pattern before seeing your new field in the Discover view. You need to do this every time your index mapping changes.

Since 7.11, the index pattern are being refreshed automatically whenever needed.

Upvotes: 2

Related Questions