Updating documents in Elasticsearch - Step-by-Step Execution

Concept Flow - Updating documents

Start: Identify document

↓

Prepare update request

↓

Send update to Elasticsearch

↓

Elasticsearch finds document

↓

Apply changes

↓

Save updated document

↓

Return update response

↓

End

The update process finds the document, applies changes, saves it, and returns a response.

Execution Sample

Elasticsearch

POST /my_index/_update/1
{
  "doc": { "field": "new value" }
}

This updates the document with ID 1 in 'my_index', changing 'field' to 'new value'.

Execution Table

Step	Action	Request Content	Elasticsearch Response	Notes
1	Receive update request	{"doc": {"field": "new value"}}	Acknowledged	Request targets document ID 1
2	Find document by ID	ID=1	Document found	Document exists in 'my_index'
3	Apply update	Change 'field' to 'new value'	Update applied	Only specified fields changed
4	Save updated document	Updated document stored	Document saved	Changes persisted
5	Return response	Update result	{"_id":"1","result":"updated"}	Client informed of success
6	End	-	-	Update process complete

💡 Update completes after document is saved and response returned.

Variable Tracker

Variable	Start	After Step 3	Final
document.field	"old value"	"new value"	"new value"
update_status	null	"applied"	"completed"

Key Moments - 3 Insights

Why does the update only change specified fields and not replace the whole document?

Because the update request uses the 'doc' field, which tells Elasticsearch to merge changes into the existing document (see execution_table step 3).

What happens if the document ID does not exist?

Elasticsearch returns a 'not found' error and does not apply any changes (not shown in this trace but would stop at step 2).

Can we update multiple fields at once?

Yes, by including multiple fields inside the 'doc' object in the update request (similar to step 1).

Visual Quiz - 3 Questions

Look at the execution table, what is the value of 'document.field' after step 3?

A "old value"

B null

C "new value"

D "updated"

💡 Hint

Check variable_tracker row for 'document.field' after step 3.

At which step does Elasticsearch save the updated document?

A Step 3

B Step 4

C Step 2

D Step 5

💡 Hint

Look at execution_table action descriptions for saving.

If the document ID was missing, what would happen in the execution flow?

A Error at step 2, no update applied

B Update saved with new ID

C Update applied anyway

D Response returned with success

💡 Hint

Refer to key_moments about missing document behavior.

Concept Snapshot

Updating documents in Elasticsearch:
Use POST /index/_update/id
Include 'doc' with fields to change
Elasticsearch merges changes, not replaces
Returns update status after saving
Errors if document not found

Full Transcript

This visual trace shows how Elasticsearch updates a document. First, it receives an update request specifying the document ID and fields to change. Then it finds the document by ID. If found, it applies the changes only to specified fields, merges them into the existing document, and saves the updated document. Finally, it returns a response confirming the update. If the document does not exist, Elasticsearch returns an error and stops the update. This process ensures partial updates without replacing the whole document.

Practice

1. What does the _update API in Elasticsearch do?

easy

A. It retrieves a document by its ID.

B. It modifies specific fields of an existing document without replacing the whole document.

C. It creates a new index with updated settings.

D. It deletes the entire document from the index.

Solution

1. Step 1: Understand the purpose of _update API

   The _update API is designed to change parts of a document without replacing the entire document.

2. Step 2: Compare options with the API function

   Only It modifies specific fields of an existing document without replacing the whole document. correctly describes modifying specific fields without full replacement, while others describe unrelated actions.

3. Final Answer:

   It modifies specific fields of an existing document without replacing the whole document. -> Option B

4. Quick Check:

   _update API modifies parts of a document [OK]

Hint: Remember _update changes parts, not whole documents [OK]

Common Mistakes:

• Thinking _update deletes documents
• Confusing _update with document retrieval
• Assuming _update creates new indexes

2. Which of the following is the correct syntax to update the field status to "active" in a document with ID 1 in index users?

easy

A. PUT /users/_update/1 { "status": "active" }

B. GET /users/_update/1 { "doc": { "status": "active" } }

C. POST /users/_update/1 { "doc": { "status": "active" } }

D. POST /users/_doc/1 { "status": "active" }

Solution

1. Step 1: Identify the correct HTTP method and endpoint

   The update API uses POST method with the path /index/_update/document_id.

2. Step 2: Check the request body format

   The fields to update must be inside the doc object. POST /users/_update/1 { "doc": { "status": "active" } } matches this format exactly.

3. Final Answer:

   POST /users/_update/1 { "doc": { "status": "active" } } -> Option C

4. Quick Check:

   Use POST with _update and doc object [OK]

Hint: Use POST with _update and put fields inside doc [OK]

Common Mistakes:

• Using GET instead of POST for update
• Omitting the doc wrapper in the body
• Using _doc endpoint instead of _update

3. Given this update request:

POST /products/_update/42
{
  "doc": {
    "price": 19.99
  }
}

What happens to the other fields of the document with ID 42?

medium

A. They remain unchanged; only the price field is updated.

B. They are deleted and replaced by only the price field.

C. The update request will fail due to missing fields.

D. All fields are reset to default values.

Solution

1. Step 1: Understand partial update behavior

   The _update API updates only the fields inside the doc object, leaving other fields intact.

2. Step 2: Analyze the given request

   Only the price field is specified, so other fields stay as they were.

3. Final Answer:

   They remain unchanged; only the price field is updated. -> Option A

4. Quick Check:

   _update changes specified fields only [OK]

Hint: Update changes only fields inside doc, others stay same [OK]

Common Mistakes:

• Assuming update replaces whole document
• Expecting update to fail without all fields
• Thinking update resets other fields

4. You try to update a document but get an error. Which of these is the most likely cause?

POST /orders/_update/100
{
  "status": "shipped"
}

medium

A. Using POST instead of PUT method.

B. The index name is incorrect.

C. Document ID 100 does not exist.

D. Missing the doc wrapper around the fields to update.

Solution

1. Step 1: Check the update request format

   The update body must have a doc object wrapping the fields to update.

2. Step 2: Identify the error in the request

   The request body lacks the doc wrapper, causing a syntax error.

3. Final Answer:

   Missing the doc wrapper around the fields to update. -> Option D

4. Quick Check:

   Update body needs doc wrapper [OK]

Hint: Always wrap updated fields inside doc object [OK]

Common Mistakes:

• Omitting doc wrapper in update body
• Confusing POST and PUT methods
• Assuming missing document causes syntax error

5. You want to increase the stock field by 5 in a product document with ID 10. Which update request correctly does this?

hard

A. POST /products/_update/10 { "script": "ctx._source.stock += 5" }

B. POST /products/_update/10 { "doc": { "stock": "+5" } }

C. POST /products/_update/10 { "doc": { "stock": 5 } }

D. POST /products/_update/10 { "update": { "stock": 5 } }

Solution

1. Step 1: Understand how to increment a field

   To increase a numeric field, use a script that modifies the field value.

2. Step 2: Analyze each option

   POST /products/_update/10 { "script": "ctx._source.stock += 5" } uses a script to add 5 to stock. Others either overwrite or use wrong syntax.

3. Final Answer:

   POST /products/_update/10 { "script": "ctx._source.stock += 5" } -> Option A

4. Quick Check:

   Use script to increment numeric fields [OK]

Hint: Use script with ctx._source.field += value to increment [OK]

Common Mistakes:

• Trying to increment by setting doc field directly
• Using incorrect JSON structure for update
• Confusing doc and script usage