Creating a new field into existing index - ElasticSearch

Question

I am wanting to create a new field and add it to an existing index so that way I can send a unique value to that new field. I was hoping there was an API to do this without having to do it in the CLI of Kibana. But I ran into this article that tells you how to add new fields to an existing index.

I tried to add it under _source field but it did not allow me.

PUT customer-simulation-es-app-logs-development-2021-07/_mapping
{
  "_source":{
    "TransactionKey":{
      "type": "keyword"
    }
  }
}

So I then added it to properties which allowed me:

PUT customer-simulation-es-app-logs-development-2021-07/_mapping
{
  "properties":{
    "TransactionKey":{
      "type": "keyword"
    }
  }
}

To make sure it was updated I ran the cmd GET customer-simulation-es-app-logs-development-2021-07/_mapping which did return it.

{
  "customer-simulation-es-app-logs-development-2021-07" : {
    "mappings" : {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "TransactionKey" : {
          "type" : "keyword"
        },
        "exceptions" : {
          "properties" : {
            "ClassName" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
.....

But when I go to Discover and type in TransactionKey for the fields nothing pops up. Did I not add the new field correctly to the existing index?

Val · Accepted Answer · 2021-07-30 03:31:29Z

2

If you're running a version prior to 7.11, then you need to go to Stack Management > Index pattern and refresh your index pattern before seeing your new field in the Discover view. You need to do this every time your index mapping changes.

Since 7.11, the index pattern are being refreshed automatically whenever needed.

answered Jul 30, 2021 at 3:31

Val

218k14 gold badges377 silver badges384 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

MarkCo Over a year ago

Thank you! I am running on 7.13 however, I do not see the option under "Available fields" only if I click on add filter it will show up. Does it not show up under "Available fields" if there is no values sent to the new field that was created? On another note, is there a way to attach a value to the newly created field?

Val Over a year ago

You need to populate some value in that field in the existing documents in order for that field to show up in "Available fields".

MarkCo Over a year ago

Makes sense now! Appreciate it! :)

Collectives™ on Stack Overflow

Creating a new field into existing index - ElasticSearch

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related