Renaming fields in elasticsearch

Question

I have a document like this

{
    \"_index\": \"testindex\",
    \"_type\": \"logs\",
    \"_id\": \"1\",
    \"_score\": 1,
    \"_source\": {
      \"field         


        

Answer 1

The Request field does not yet exist in your documents, so your script needs to create it first:

POST _reindex
{
    "source": {
        "index": "testindex"
    },
    "dest": {
        "index": "testindex1"
    },
    "script": {
        "inline": "ctx._source.Request = [:]; ctx._source.Request.field3 = ctx._source.remove(\"field2\") ]"
    }
}

Or a bit shorter like this:

POST _reindex
{
    "source": {
        "index": "testindex"
    },
    "dest": {
        "index": "testindex1"
    },
    "script": {
        "inline": "ctx._source.Request = [field3: ctx._source.remove(\"field2\") ]"
    }
}

Answer 2

The easiest way to rename the field name is to use the _update_by_query API:

Example: POST http://localhost:9200/INDEX_NAME/_update_by_query

{
  "query": { 
    "bool": {
        "must_not": {
            "exists": {
                "field": "NEW_FIELD_NAME"
            }
        }
    }
  },
  "script" : {
    "inline": "ctx._source.NEW_FIELD_NAME = ctx._source.OLD_FIELD_NAME; ctx._source.remove(\"OLD_FIELD_NAME\");"
  }
}