Updating documents in Elasticsearch

Introduction

Updating documents lets you change information already saved in Elasticsearch without deleting and adding it again.

You want to fix a typo in a saved record.

You need to add new details to an existing document.

You want to increase a count or score stored in a document.

You want to change the status of an order or task.

You want to update a timestamp to show the last change.

Syntax

Elasticsearch

POST /index_name/_update/document_id
{
  "doc": {
    "field_name": "new_value"
  }
}

Use POST method with _update endpoint to change a document.

Inside the JSON body, use "doc" to specify only the fields you want to update.

Examples

This updates the price field of the document with ID 1 in the products index.

Elasticsearch

POST /products/_update/1
{
  "doc": {
    "price": 19.99
  }
}

This sets the last_login field to a new date for user with ID 42.

Elasticsearch

POST /users/_update/42
{
  "doc": {
    "last_login": "2024-06-01T12:00:00"
  }
}

This changes the status of order 100 to shipped.

Elasticsearch

POST /orders/_update/100
{
  "doc": {
    "status": "shipped"
  }
}

Sample Program

This updates the document with ID 123 in the library index, changing the title and availability.

Elasticsearch

POST /library/_update/123
{
  "doc": {
    "title": "Learn Elasticsearch",
    "available": true
  }
}

Important Notes

If the document does not exist, Elasticsearch can create it if you add "doc_as_upsert": true.

Only the fields inside "doc" are changed; other fields stay the same.

You can also use scripts to update fields based on their current values.

Summary

Use the _update API to change parts of a saved document.

Send only the fields you want to change inside the "doc" object.

Elasticsearch updates the document without replacing it fully.

Practice

1. What does the _update API in Elasticsearch do?

easy

A. It retrieves a document by its ID.

B. It modifies specific fields of an existing document without replacing the whole document.

C. It creates a new index with updated settings.

D. It deletes the entire document from the index.

Solution

1. Step 1: Understand the purpose of _update API

   The _update API is designed to change parts of a document without replacing the entire document.

2. Step 2: Compare options with the API function

   Only It modifies specific fields of an existing document without replacing the whole document. correctly describes modifying specific fields without full replacement, while others describe unrelated actions.

3. Final Answer:

   It modifies specific fields of an existing document without replacing the whole document. -> Option B

4. Quick Check:

   _update API modifies parts of a document [OK]

Hint: Remember _update changes parts, not whole documents [OK]

Common Mistakes:

• Thinking _update deletes documents
• Confusing _update with document retrieval
• Assuming _update creates new indexes

2. Which of the following is the correct syntax to update the field status to "active" in a document with ID 1 in index users?

easy

A. PUT /users/_update/1 { "status": "active" }

B. GET /users/_update/1 { "doc": { "status": "active" } }

C. POST /users/_update/1 { "doc": { "status": "active" } }

D. POST /users/_doc/1 { "status": "active" }

Solution

1. Step 1: Identify the correct HTTP method and endpoint

   The update API uses POST method with the path /index/_update/document_id.

2. Step 2: Check the request body format

   The fields to update must be inside the doc object. POST /users/_update/1 { "doc": { "status": "active" } } matches this format exactly.

3. Final Answer:

   POST /users/_update/1 { "doc": { "status": "active" } } -> Option C

4. Quick Check:

   Use POST with _update and doc object [OK]

Hint: Use POST with _update and put fields inside doc [OK]

Common Mistakes:

• Using GET instead of POST for update
• Omitting the doc wrapper in the body
• Using _doc endpoint instead of _update

3. Given this update request:

POST /products/_update/42
{
  "doc": {
    "price": 19.99
  }
}

What happens to the other fields of the document with ID 42?

medium

A. They remain unchanged; only the price field is updated.

B. They are deleted and replaced by only the price field.

C. The update request will fail due to missing fields.

D. All fields are reset to default values.

Solution

1. Step 1: Understand partial update behavior

   The _update API updates only the fields inside the doc object, leaving other fields intact.

2. Step 2: Analyze the given request

   Only the price field is specified, so other fields stay as they were.

3. Final Answer:

   They remain unchanged; only the price field is updated. -> Option A

4. Quick Check:

   _update changes specified fields only [OK]

Hint: Update changes only fields inside doc, others stay same [OK]

Common Mistakes:

• Assuming update replaces whole document
• Expecting update to fail without all fields
• Thinking update resets other fields

4. You try to update a document but get an error. Which of these is the most likely cause?

POST /orders/_update/100
{
  "status": "shipped"
}

medium

A. Using POST instead of PUT method.

B. The index name is incorrect.

C. Document ID 100 does not exist.

D. Missing the doc wrapper around the fields to update.

Solution

1. Step 1: Check the update request format

   The update body must have a doc object wrapping the fields to update.

2. Step 2: Identify the error in the request

   The request body lacks the doc wrapper, causing a syntax error.

3. Final Answer:

   Missing the doc wrapper around the fields to update. -> Option D

4. Quick Check:

   Update body needs doc wrapper [OK]

Hint: Always wrap updated fields inside doc object [OK]

Common Mistakes:

• Omitting doc wrapper in update body
• Confusing POST and PUT methods
• Assuming missing document causes syntax error

5. You want to increase the stock field by 5 in a product document with ID 10. Which update request correctly does this?

hard

A. POST /products/_update/10 { "script": "ctx._source.stock += 5" }

B. POST /products/_update/10 { "doc": { "stock": "+5" } }

C. POST /products/_update/10 { "doc": { "stock": 5 } }

D. POST /products/_update/10 { "update": { "stock": 5 } }

Solution

1. Step 1: Understand how to increment a field

   To increase a numeric field, use a script that modifies the field value.

2. Step 2: Analyze each option

   POST /products/_update/10 { "script": "ctx._source.stock += 5" } uses a script to add 5 to stock. Others either overwrite or use wrong syntax.

3. Final Answer:

   POST /products/_update/10 { "script": "ctx._source.stock += 5" } -> Option A

4. Quick Check:

   Use script to increment numeric fields [OK]

Hint: Use script with ctx._source.field += value to increment [OK]

Common Mistakes:

• Trying to increment by setting doc field directly
• Using incorrect JSON structure for update
• Confusing doc and script usage