I'm using ElasticSearch for an application in order to store and search for data.
Because it's also important to search for relationships in my particular case, I recently changed the structure of my data and I am using the _parent field now. (http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/mapping-parent-field.html)
I already designed the search query, which works perfectly fine. However, I now have a problem when inserting a new child entry in my database.
It should work this way:
Without the _parent field, when I wanted to achieve this
$ curl -XPUT 'http://localhost:9200/data/child/1' -d '
I inserted the data this way using the JEST API:
client.execute(new Index.Builder(payload).index("data").type("child").build());
When I want to achieve this:
$ curl -XPOST localhost:9200/data/child?parent=154121-d'
How am I supposed to implement this using the JEST-API?
It's possible to provide a parameter for the request. The correct line of code to achieve this:
$ curl -XPOST localhost:9200/data/child?parent=154121-d'
would be achieved with this:
client.execute(new Index.Builder(payload).index("data").type("child").setParameter("parent", "154121").build());
Related
I am fairly new to the elastic search, and I am using the Elastic App Search.
So I am trying to update data in elastic app-search through MongoDB Realm App which basically provide triggers on CRUD operations.
I am able to add documents or update existing fields.
But the problem is I am unable to add elements to the array field. I want to add or delete elements from array, after some research I found out that it can be done using some scripts:
"script": {
"source": "ctx._source.fieldToUpdate.add(elementToAdd);",
"lang": "painless"
}
But it's just not working. I am using REST APIs to add or update data in elastic app search. And I am using elastic cloud managed service.
UPDATE - 1
I was using ES App Search, and I created and named the engine as "articles", when I tried to run queries using kibana, I had to use some weird name ".ent-search-engine-documents-article".
So I tried using the same name in Elastic Search REST API
POST /.ent-search-engine-documents-article/_update/docid
And it worked perfectly fine, but I want to perform the same work using REST API of APP Search only.
To perform CRUD operations on your data stored through AppSearch, you should use the Documents API.
AppSearch does not handle nested objects and only provides 4 field types: text, number, date and geolocation. if you are posting objects, it will flatten and stringify them as you described in your comment.
It's also the case for arrays, so you can't just add elements to a field that holds an array as it's just a text field, you need to re-write the whole field (though it does detect them as arrays and handles each element separately if you use that field as a facet for instance).
as for how to patch with the AppSearch REST API, here's a small example inspired from the official documentation:
curl -X PATCH 'https://[instance id].ent-search.[region].[provider].cloud.es.io:443/api/as/v1/engines/articles/documents' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer private-xxxxxxxxxxxxxxxxxxxx' \
-d '[
{ "id": "your_article_id",
"source": "your article source",
"lang": "painless" }
]'
There are also clients for several programming languages that you may find helpful or more intuitive to use.
The weird names you see for your engines, like ".ent-search-engine-documents-article" are the underlying indices on ElasticSearch, and you normally would not like to manipulate them directly.
I am using Elasticsearch 7.4, and have a unique requirement to perform below operation in elasticsearch through painless script:-
Update the field through painless script
Get the updated value in response
#1 I can perform using painless script using below to update the counter value, but how can I get the updated value in response? I want the new value ctx._source.counter in response of the POST call I made, Is there any way?
curl -XPOST -H "Content-Type:application/json" localhost:9200/myindex/_update_by_query -d "{"query":{"bool":{"filter":[{"match":{"field1":"1"}}]}},"script":{"source":"ctx._source.counter = ctx._source.counter + params.incrementValue","lang":"painless","params":{"incrementValue":"2"}}}"
What you want is different from the specs of the _update_by_query API. In the specs you can see the response only contains stats & status of the update, and not the document body (neither initial or final).
One way to accomplish your goal is:
Query document to update ie. where field1==1
Get initial counter value
Update
With this, you can get compute the updated value at your end with the method of your choice. In any case it would be two API calls not just one.
I need to Get data for an index for a timeframe using curl or using url.
I was able to get the data using below created url
http://localhost:9200/index_name/_search?size=10&q="* AND severity:major|critical"
but I am not sure where to provide the timeframe for example i only want data from last 15minutes.
Can anyone help me with a way it can be done
You can do it like this by adding #timestamp:[now-15m TO now] to your query:
http://localhost:9200/index_name/_search?size=10&q="* AND severity:major|critical AND #timestamp:[now-15m TO now]"
I try to use hot/warm architecture,but there are already a lot indexs.
Can i add the index.routing.allocation.require.box_type tag to the old index?
you should set index settings using api methods. For all indices use _all.
Example:
curl -XPUT -d '{"index.routing.allocation.require.box_type": "warm"}' localhost:9200/_all/_settings?preserve_existing=true
Params preserve_existing=true means do not override existing box_type
I want to delete index entries directly from MOBZ's ElasticSearch head (web UI).
I tried a DELETE query in the "Any Request" section with the following:
{"query":{"term":{"supplier":"ABC"}}}
However, all I get in return is:
{
ok: true
acknowledged: true
}
and the entries do not get deleted.
What am I doing wrong?
You should have removed the "query" from your post data.
You only need it for _search, and you should be using the _query entrypoint for delete.
In that case it is obvious the post is only a query, thus making it redendant (and actually irrelevant) to explicitly state it's a query.
That is:
curl -XPOST 'localhost:9200/myindex/mydoc/_search' -d
'{"query":{"term":{"supplier":"ABC"}}}'
will work fine for search.
But to delete by query, if you try:
curl -XDELETE 'localhost:9200/myindex/mydoc/_query' -d
'{"query":{"term":{"supplier":"ABC"}}}'
it won't work (note the change in entry point to _query, as well as switch CURL parameter to delete).
You need to call:
curl -XDELETE 'localhost:9200/myindex/mydoc/_query' -d
'{"term":{"supplier":"ABC"}}'
Let me know if this helps.
If you want to do it in HEAD:
put /stock/one/_query in the any request text box next to the drop-box of "GET/PUT/POST/DELETE"
choose DELETE in the drop-down menu
the request body should be {"term":{"vendor":"Socks"}}
Your problem was that you used a request body of: {"query":{"term":{"vendor":"Socks"}}}
That is fine for search, but not for delete.
A simple way to delete from plugin head by doc Id:
Go to Any Request TAB in plugin head
Simply put http:/localhost:9200/myindex/indextype/id in the text box above DELETE drop-down
Select DELETE from drop-down
Execute the request by clicking in Request button
Here is the sample image:
I'd issue a search request first, to verify that the documents you want deleted are actually being returned by your query.
It's impossible to give clear help, since there are many things that could be going wrong, but here are some possible probelems:
You don't have the correct index/type specified in the ES Head query
You need to specify the index and type on the second input box, not the first. The first line is meant for the host address and automatically adds a trailing slash
You need to use the Delete command from the dropdown
The analyzer of your fields is altering the field text in a way that it isn't being found by the Term query.
In all likelihood, it is the last option. If you haven't specified an analyzer, the default one that ES picks is the Standard analyzer, which includes a lowercase filter. The term "ABC" is therefore never indexed, instead "abc" is indexed.
Term query is not analyzed at all, so case sensitivity is important.
If those tips don't help, post up your mapping and some sample data, and we can probably help better.