How to update and strip the first character of an array field in elasticsearch - elasticsearch

Question

I have the following within an index in elastic search listed as a json doc
Current
{
"bar": {
"bar": [{
"bar": [{
"bar": [{
"foo": "Y111111111111"
}
]
}
]
}
}
}
Update needed
{
"bar": {
"bar": [{
"bar": [{
"bar": [{
"foo": "111111111111"
}
]
}
]
}
}
}
How would I go about updating the index to strip the first character of the string where equal to bar?
I tried the following syntax which works for a single field but I receive an exception when running on an array field
{
"error": {
"root_cause": [
{
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"ctx._source.foo = ctx._source.foo.substring(1);",
" ^---- HERE"
],
"script": "ctx._source.foo = ctx._source.foo.substring(1);",
"lang": "painless"
}
],
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"ctx._source.foo = ctx._source.foo.substring(1);",
" ^---- HERE"
],
"script": "ctx._source.foo = ctx._source.foo.substring(1);",
"lang": "painless",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Illegal list shortcut value [foo]."
}
},
"status": 400
}
POST test/_update_by_query
{
"query": {
"prefix": {
"foo": "Y"
}
},
"script": {
"source": "ctx._source.foo = ctx._source.foo.substring(1);"
}
Mapping
{
"TEST": {
"mappings": {
"properties": {
"bar": {
"properties": {
"bar": {
"properties": {
"bar: {
"properties": {
"bar": {
"properties": {
"foo": {
"type": "keyword"
}
}
}
}
}
}
}
}
}
}
}
}
}

Answer 1

I would do it as follows. Find all documents whose foo field starts with Y and then update all the foo fields by stripping the first character:
POST test/_update_by_query
{
"query": {
"prefix": {
"bar.bar.bar.bar.foo": "Y"
}
},
"script": {
"source": "ctx._source.bar.bar[0].bar[0].bar[0].foo = ctx._source.bar.bar[0].bar[0].bar[0].foo.substring(1);"
}
}
PS: the query will depend on whether your bar fields are nested or not, but in case they are not, the above query should work.