How to update multiple documents that match a query in elasticsearch

by

You could use the update by query plugin in order to do just that. The idea is to select all document without a category and whose url matches a certain string and add the category you wish.

curl -XPOST 'localhost:9200/webproxylog/_update_by_query' -H "Content-Type: application/json" -d '
{
  "query": {
    "filtered": {
      "filter": {
        "bool": {
          "must": [
            {
              "term": {
                "url": "stackoverflow.com"
              }
            },
            {
              "missing": {
                "field": "category"
              }
            }
          ]
        }
      }
    }
  },
  "script" : "ctx._source.category = \"10\";"
}'

After running this, all your documents with url: stackoverflow.com that don’t have a category, will get category: 10. You can run the same query again later to fix new stackoverflow.com documents that have been indexed in the meantime.

Also make sure to enable scripting in elasticsearch.yml and restart ES: 

script.inline: on 
script.indexed: on

In the script, you’re free to add as many fields as you want, e.g.

  ...
  "script" : "ctx._source.category1 = \"10\"; ctx._source.category2 = \"20\";"

UPDATE

ES 2.3 now features the update by query functionality. You can still use the above query exactly as is and it will work (except that filtered and missing are deprecated, but still working ;).

More Related Contents:

  1. Elasticsearch replication of other system data?
  2. How to search for a part of a word with ElasticSearch
  3. no [query] registered for [filtered]
  4. elasticsearch bool query combine must with OR
  5. ElasticSearch – Return Unique Values
  6. Elasticsearch: Difference between “Term”, “Match Phrase”, and “Query String”
  7. Remove duplicate documents from a search in Elasticsearch
  8. Elasticsearch 2.1: Result window is too large (index.max_result_window)
  9. Max limit on the number of values I can specify in the ids filter or generally query clause?
  10. UTF8 encoding is longer than the max length 32766
  11. Queries vs. Filters
  12. Why do I need “store”:”yes” in elasticsearch?
  13. Change default mapping of string to “not analyzed” in Elasticsearch
  14. How to not-analyze in ElasticSearch?
  15. elasticsearch – what to do with unassigned shards
  16. Elasticsearch vs Cassandra vs Elasticsearch with Cassandra
  17. FIELDDATA Data is too large
  18. Find documents with empty string value on elasticsearch
  19. How to get latest values for each group with an Elasticsearch query?
  20. Elasticsearch, Tire, and Nested queries / associations with ActiveRecord
  21. How to create unique constraint in Elasticsearch database?
  22. ElasticSearch: Unassigned Shards, how to fix?
  23. Content-Type header [application/x-www-form-urlencoded] is not supported on Elasticsearch
  24. Elasticsearch, Failed to obtain node lock, is the following location writable
  25. low disk watermark [??%] exceeded on
  26. Elasticsearch – set max_clause_count
  27. How to bind Elasticsearch 2.0 on both Loopback and Non-Loopback interfaces?
  28. How to use the official docker elasticsearch container?
  29. Remove a field from a Elasticsearch document
  30. How to create multiple indexes in logstash.conf file?

Leave a Comment