Search code examples
elasticsearchkibanaelastic-stackelk

Null field in elasticsearch need to be replaced


How can i replace the "build_duration" : "null", with value 21600000 in elasticsearch?

DevTools > Console

GET myindex/_search
{
  "query": {
    "term": {
      "build_duration": "null" 
    }
  }
}

Output:-

{
  "took" : 10,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 9.658761,
    "hits" : [
      {
        "_index" : "myindex",
        "_type" : "_doc",
        "_id" : "40324749",
        "_score" : 9.658761,
        "_source" : {
        "build_duration" : "null",
        "build_end_time" : "2021-05-20 04:00:36",
        "build_requester" : "daniel.su",
        "build_site" : "POL",
        "build_id" : "40324749",
        "@version" : "1"
        }
      }
    ]
  }
}

Solution

  • With below query able to replace the filed value.

      POST /myindex/_update/mydocid
        {
            "doc" : {
                "build_duration": "21600000"
            }
        }