elasticsearch - Updating indexed document in Elasticsearch

Question

I am trying to understand how you update an indexed document in Elasticsearch. I don't understand how it works? What is the ctx that the API is referring to doing? Let say you have a document with nested documents what do you have to do to update it?

And what is the difference between deleting the document and then index the "updated" version, vs a plain update?

Answer 1

The update request retrieve source from Elasticsearch, modifies it and indexes it back to Elasticsearch. If you already have a copy of the document using update makes little sense. It would be generally faster to just index the new version. However, if you don't have the document readily available but you know which changes you would like to make to the document, it might be more efficient to use update.

For example, if I don't have a copy of the car document, but I want to add a new creator I can do something like this:

curl -XDELETE localhost:9200/test

curl -XPUT localhost:9200/test -d '{
    "settings": {
        "index.number_of_shards": 1,
        "index.number_of_replicas": 0
    },
    "mappings": {
        "car": {
            "properties": {
                "creators" : {
                    "type": "nested",
                    "properties": {
                        "name": {"type":"string"}
                    }
                }
            }
        }
    }
}
'

curl -XPOST localhost:9200/test/car/1 -d '{
    "creators": [{
        "name": "Steve"
    }]
}
'

echo
curl -XPOST localhost:9200/test/car/1/_update -d '{
    "script" : "ctx._source.creators += new_creator",
    "params" : {
        "new_creator" : {"name": "John"}
    }
}'

echo
curl "localhost:9200/test/car/1?pretty=true"
echo

In the update script ctx is a special variable that allows you to access the source of the object that you want to update. The ctx._source is a writable version of the source. You can modify this document in the script and the modified source will be persisted as the new version of the document.

Answer 2

Here is how to update a document with nested customer documents in ElasticSearch 7.3:

POST /myindex/_doc/mypartid/_update
{
    "script" : {
        "source": "ctx._source.customers.add(params.newcust)",
        "params" : {
            "newcust" : {"customer": "cust3"}
        }
    }
}

Results in:

GET /myindex/_doc/mypartid
{
    "_index": "myindex2",
    "_type": "_doc",
    "_id": "mypartid",
    ...
    "_source": {
        "part": "my part",
        "customers": [
            {"customer": "cust1"},
            {"customer": "cust3"}
        ],
        "machines": [
            {"machine": "mach7"},
            {"machine": "mach2"}
        ]
    }
}

So, for ES7+ the URL has changed as have the way you do scripts and which operations an array can have (+= does not work).