Updating documents in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the _update API in Elasticsearch?

The _update API allows you to change parts of a document without replacing the entire document. It updates only the specified fields.

intermediate

How do you update a document's field using a script in Elasticsearch?

You use the script parameter in the _update API to modify fields dynamically. For example, increment a counter or change a value based on current data.

intermediate

What happens if you try to update a document that does not exist in Elasticsearch?

By default, the update will fail with a 404 error. But you can use doc_as_upsert: true to create the document if it doesn't exist.

intermediate

Explain the difference between doc and upsert in an update request.

doc contains the fields to update in an existing document. upsert provides a document to insert if the original document does not exist.

beginner

Why is partial update preferred over reindexing the whole document?

Partial update changes only the needed fields, saving time and resources. Reindexing the whole document is slower and can cause more load on the system.

Which Elasticsearch API is used to modify parts of an existing document?

A _delete

B _search

C _update

D _bulk

The _update API is designed to update parts of a document without replacing it entirely.

What does setting doc_as_upsert: true do in an update request?

A Deletes the document if it exists

B Prevents any update from happening

C Updates all documents in the index

D Creates the document if it does not exist

Setting doc_as_upsert: true tells Elasticsearch to insert the document if it does not already exist.

How can you increment a numeric field in a document during update?

A Using a script in the update request

B By deleting and reindexing the document

C Using the _search API

D By changing the mapping

You can use a script in the _update API to increment numeric fields dynamically.

If you want to replace the entire document, which API should you use?

A _update

B _index

C _search

D _bulk

The _index API replaces the whole document when you provide the same ID.

What is a benefit of partial updates over full document replacement?

A Uses less network and processing resources

B Deletes the document faster

C Changes the index mapping automatically

D Prevents any data loss

Partial updates only send and change the fields needed, saving bandwidth and processing time.

Describe how to update a document in Elasticsearch using the _update API with a script.

Think about changing a field value without sending the whole document.

Explain the difference between using doc and upsert in an update request.

One updates, the other creates if missing.

Practice

1. What does the _update API in Elasticsearch do?

easy

A. It retrieves a document by its ID.

B. It modifies specific fields of an existing document without replacing the whole document.

C. It creates a new index with updated settings.

D. It deletes the entire document from the index.

Solution

1. Step 1: Understand the purpose of _update API

   The _update API is designed to change parts of a document without replacing the entire document.

2. Step 2: Compare options with the API function

   Only It modifies specific fields of an existing document without replacing the whole document. correctly describes modifying specific fields without full replacement, while others describe unrelated actions.

3. Final Answer:

   It modifies specific fields of an existing document without replacing the whole document. -> Option B

4. Quick Check:

   _update API modifies parts of a document [OK]

Hint: Remember _update changes parts, not whole documents [OK]

Common Mistakes:

• Thinking _update deletes documents
• Confusing _update with document retrieval
• Assuming _update creates new indexes

2. Which of the following is the correct syntax to update the field status to "active" in a document with ID 1 in index users?

easy

A. PUT /users/_update/1 { "status": "active" }

B. GET /users/_update/1 { "doc": { "status": "active" } }

C. POST /users/_update/1 { "doc": { "status": "active" } }

D. POST /users/_doc/1 { "status": "active" }

Solution

1. Step 1: Identify the correct HTTP method and endpoint

   The update API uses POST method with the path /index/_update/document_id.

2. Step 2: Check the request body format

   The fields to update must be inside the doc object. POST /users/_update/1 { "doc": { "status": "active" } } matches this format exactly.

3. Final Answer:

   POST /users/_update/1 { "doc": { "status": "active" } } -> Option C

4. Quick Check:

   Use POST with _update and doc object [OK]

Hint: Use POST with _update and put fields inside doc [OK]

Common Mistakes:

• Using GET instead of POST for update
• Omitting the doc wrapper in the body
• Using _doc endpoint instead of _update

3. Given this update request:

POST /products/_update/42
{
  "doc": {
    "price": 19.99
  }
}

What happens to the other fields of the document with ID 42?

medium

A. They remain unchanged; only the price field is updated.

B. They are deleted and replaced by only the price field.

C. The update request will fail due to missing fields.

D. All fields are reset to default values.

Solution

1. Step 1: Understand partial update behavior

   The _update API updates only the fields inside the doc object, leaving other fields intact.

2. Step 2: Analyze the given request

   Only the price field is specified, so other fields stay as they were.

3. Final Answer:

   They remain unchanged; only the price field is updated. -> Option A

4. Quick Check:

   _update changes specified fields only [OK]

Hint: Update changes only fields inside doc, others stay same [OK]

Common Mistakes:

• Assuming update replaces whole document
• Expecting update to fail without all fields
• Thinking update resets other fields

4. You try to update a document but get an error. Which of these is the most likely cause?

POST /orders/_update/100
{
  "status": "shipped"
}

medium

A. Using POST instead of PUT method.

B. The index name is incorrect.

C. Document ID 100 does not exist.

D. Missing the doc wrapper around the fields to update.

Solution

1. Step 1: Check the update request format

   The update body must have a doc object wrapping the fields to update.

2. Step 2: Identify the error in the request

   The request body lacks the doc wrapper, causing a syntax error.

3. Final Answer:

   Missing the doc wrapper around the fields to update. -> Option D

4. Quick Check:

   Update body needs doc wrapper [OK]

Hint: Always wrap updated fields inside doc object [OK]

Common Mistakes:

• Omitting doc wrapper in update body
• Confusing POST and PUT methods
• Assuming missing document causes syntax error

5. You want to increase the stock field by 5 in a product document with ID 10. Which update request correctly does this?

hard

A. POST /products/_update/10 { "script": "ctx._source.stock += 5" }

B. POST /products/_update/10 { "doc": { "stock": "+5" } }

C. POST /products/_update/10 { "doc": { "stock": 5 } }

D. POST /products/_update/10 { "update": { "stock": 5 } }

Solution

1. Step 1: Understand how to increment a field

   To increase a numeric field, use a script that modifies the field value.

2. Step 2: Analyze each option

   POST /products/_update/10 { "script": "ctx._source.stock += 5" } uses a script to add 5 to stock. Others either overwrite or use wrong syntax.

3. Final Answer:

   POST /products/_update/10 { "script": "ctx._source.stock += 5" } -> Option A

4. Quick Check:

   Use script to increment numeric fields [OK]

Hint: Use script with ctx._source.field += value to increment [OK]

Common Mistakes:

• Trying to increment by setting doc field directly
• Using incorrect JSON structure for update
• Confusing doc and script usage