ElasticSearch的update_by_query语句可以很方便地为原有es表修改字段和新增字段,如下面的例子所示:
1.将资产表中area为空的字段赋值为'无'
POST soc-system/_update_by_query
{
"script": {
"source": "ctx._source['area']='无'"
},
"query": {
"bool": {
"must_not": [
{
"exists": {
"field": "area"
}
}
]
}
}
}
2.添加一个网段字段,其值根据已有字段ip截取而来
POST soc-system/_update_by_query
{
"script": {
"source": "def a=ctx._source['ip'].lastIndexOf('.');def sec=ctx._source['ip'].substring(0,a);ctx._source['ipSection']=sec+'.0'"
},
"query": {
"bool": {
"must": [
{
"exists": {
"field": "ip"
}
}
]
}
}
}
其中script的语法为painless,具体语法参考这里