Renaming fields in elasticsearch

Question

I have such a document

{ "_index": "testindex", "_type": "logs", "_id": "1", "_score": 1, "_source": { "field1": "data1", "field2": "data2" } } 

I need to change field2 to Request.field3

 { "_index": "testindex", "_type": "logs", "_id": "1", "_score": 1, "_source": { "field1": "data1", "Request": { "field3": "data2" } } } 

To do this, the mapping of fields to an existing index is first added

 PUT testindex/_mapping/logs { "properties": { "Request": { "properties": { "field3" : { "type": "string" } } } } } 

Then tried to reindex

 POST _reindex { "source": { "index": "testindex" }, "dest": { "index": "testindex1" }, "script": { "inline": "ctx._source.Request.field3 = ctx._source.remove(\"field2\")" } } 

Error

 "reason": "failed to run inline script [ctx._source.Request.field3 = ctx._source.remove(\"field2\")] using lang [groovy]", "caused_by": { "type": "null_pointer_exception", "reason": "Cannot set property 'field3' on null object" } 

Answer 1

The Request field does not yet exist in your documents, so your script must first create it:

 POST _reindex { "source": { "index": "testindex" }, "dest": { "index": "testindex1" }, "script": { "inline": "ctx._source.Request = [:]; ctx._source.Request.field3 = ctx._source.remove(\"field2\") ]" } } 

Or a little shorter:

 POST _reindex { "source": { "index": "testindex" }, "dest": { "index": "testindex1" }, "script": { "inline": "ctx._source.Request = [field3: ctx._source.remove(\"field2\") ]" } }