如何在 Elasticsearch 中更新我的部分文档

Question

我刚刚开始使用 Logstash 和 Elasticsearch。

请参阅下面的代码片段。在 Elasticsearch 中，我正在尝试将 host 值从 Bhargav

更新为 Foo

我需要使用什么 curl 命令来实现这一点？假设我运行在 localhost:9200.

上使用 Elasticsearch

{
  "took": 4,
  "timed_out": false,
  "_shards": {
    "total": 15,
    "successful": 15,
    "failed": 0
  },
  "hits": {
    "total": 8,
    "max_score": 1.0,
    "hits": [
      {
        "_index": "logstash-2011.05.18",
        "_type": "apache_access",
        "_id": "yyncoyOeTgij9awB13S4WQ",
        "_score": 1.0,
        "_source": {
          "message": "134.39.72.245 - - [18/May/2011:12:40:18 -0700] \"GET /favicon.ico HTTP/1.1\" 200 1189 \"-\" \"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; .NET4.0C; .NET4.0E)\"",
          "@version": "1",
          "@timestamp": "2011-05-18T19:40:18.000Z",
          "host": "Bhargav",
          "timestamp": "18/May/2011:12:40:18 -0700",
          "verb": "GET",
          "request": "/favicon.ico",
          "httpversion": "1.1",
          "response": "200",
          "bytes": "1189",
          "referrer": "\"-\"",
          "agent": "\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; .NET4.0C; .NET4.0E)\""
        }
      },
      {
        "_index": "logstash-2011.05.18",
        "_type": "apache_access",
        "_id": "sMcXwrmTQzaiWW-zUSE7MA",
        "_score": 1.0,
        "_source": {
          "message": "134.39.72.245 - - [18/May/2011:12:40:18 -0700] \"GET /favicon.ico HTTP/1.1\" 200 1189 \"-\" \"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; .NET4.0C; .NET4.0E)\"",
          "@version": "1",
          "@timestamp": "2011-05-18T19:40:18.000Z",
          "host": "Bhargav",
          "path": "/tmp/access_log",
          "type": "apache_access",
          "clientip": "134.39.72.245",
          "ident": "-",
          "auth": "-",
          "timestamp": "18/May/2011:12:40:18 -0700",
          "verb": "GET",
          "request": "/favicon.ico",
          "httpversion": "1.1",
          "response": "200",
          "bytes": "1189",
          "referrer": "\"-\"",
          "agent": "\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; .NET4.0C; .NET4.0E)\""
        }
      }
    ]
  }
}

Answer 1

这里唯一的选择是在 UPDATE API

中使用部分更新

curl -XPOST 'localhost:9200/test/type1/1/_update' -d '{
    "doc" : {
        "host" : "Bhargav"
    }
}'

但是这只能应用于单个文档。 update by query 有现成的，你可以试试。

如何在 Elasticsearch 中更新我的部分文档

How to update part of my document in Elasticsearch

elasticsearch