Can I use ElasticSearch mapping transform to duplicate a field - elasticsearch

I read here about mapping transform: https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-transform.html
The result of the transform is indexed but the original source is
stored in the _source field.
So I thought I can use it to "copy" a field. I try:
{
"mappings":{
"opportunity":{
"transform":{
"script":"ctx._source['skill_suggest']=ctx._source['skill']"
}
}
}
}
Then I perform the query on the "skill_suggest" field but return no result (the same query on "skill" work fine).
So what I'm doing wrong?
Can I some how "copy" some fields on the fly? I want to perform full-text seach on "skill" but also the Completion Suggester but I cannot modify the data schema sent from client.

This sounds like a perfect match for multi-fields: https://www.elastic.co/guide/en/elasticsearch/reference/current/_multi_fields.html

Related

Kibana Regex check if a field Value contains another field value

I'm trying to search for documents in which a description field contains the value of a name field (from another document). I tried to do a Regex query as following :
GET inventory-full-index/_search
{
"query": {
"regexp": {
"description.description_data.value.keyword": ".*doc['name.keyword'].*"
}
}
}
It returns me interesting documents, that fit my need. The problem is that i created a document that contains "python3" in the description, and I made sure there was a document named "python3" as well. This query doesn't return this document, so i obviously missed something.
Any idea how to fix this ?

Change _type of a document in elasticsearch

I have two TYPES in my elasticsearch index. Both have same mapping. I am using one for active documents, while the other for archived ones.
Now, i want to archive a document i.e. change its _type from active to archived. Both are in same index, so i cannot reindex them as well.
Is there a way to do this in Elasticsearch 5.0 ?
Changing the type is tricky. You would have to remove and then index the document with the new type.
Why not have a field in your document indicating "activeness". Then you can use a bool query to filter by what you want:
{"query": {
"bool": {
"filter": [{"term": {"status", "active"}}],
"query": { /* your query object here */ }
}
}
}
Agree with having a field which indicates the activeness of the document.
(Or)
Use two different indices for "active" and "inactive" types.
Use aliases which map to these indices.
Aliases will give you flexibility to change your indices without downtimes.

Elasticsearch: Do I need to index '_id' filed specifically?

Looks like _id field is automatically mapped to _uid by the Elasticsearch.
I have below query to get a document by passing document's _id
query: {
match: {
_id: myDocumentId
}
}
Should I specify indexing for _id field to make above query work fast or is it taken care by using _uid filed internally?
You can just use
GET /<index_name>/<type_name>/<myDocumentId>

Elasticsearch - Extra unmapped fields on geo-shape type index

I have some extra inner fields on a geo-shape type field. For example, "shape" is a geo-shape type field which has the regular required fields like "coordinates", "radius" etc., but it may also have other fields like "metadata" which I want elasticsearch to not parse and not store in the index. For example:
"shape": {
"coordinates":[6.77,8.99]
"radius": 500
"metadata": "some value"
}
Mapping schema looks like this:
"shape":{
"type":"geo_shape"
}
How can I achieve this ? By using "dynamic": false on mapping schema does not seem to be working.
Setting dynamic to false in your root mapping, like you did, is the way to go : are your sure it desn't work? Or are you saying that because it appears in your result hit _source?
Actually, by default, the _source attribute will contains the exact same document that you submitted.
However, it doesn't mean the extra metadata field has been indexed and/or stored.
If you want to check this, request specifically that field in your search like this :
POST _search
{
"fields": ["shape.metadata"]
}
You should have your search hits but without any fields value.
If it still bother you, disabled the _source attribute in your mapping.

how to modify the type mapping in elasticsearch to another type

The thing is that I already defined a field "myvalue" as INTEGER. Now I think was a mistake and I want to store in the same field an string, so I want to change it, without loosing data, to STRING. is there any way of making it?, or I need to re-create the index and re-index the whole data?
I already tried running:
{
"mappings": {
"myvalue": {
"type":"string"
}
}
}
But if I get the mapping again from the server still appear as Integer
There is not any way to change the mapping on a core field type for existing data. You will need to re-create the index with the myvalue field defined as a string and re-index your data.

Resources