elasticsearch 使用logstash中的elasticseach脚本将传入数组文档合并到现有文档

zvokhttg  于 2022-11-02  发布在  ElasticSearch
关注(0)|答案(1)|浏览(160)

我想将新文档合并到现有文档中。现有文档如下所示:

{
    "_source": {
        "name": "xxx",
        "recall": [
            { 
                "title": "xxx-a",
                "date": "2020-12-10"
                "otherB": "abc"
            }
        ]
    }
}

新插入的文档如下:

{
    "_source": {
        "name": "xxx",
        "recall": [
            { 
                "title": "xxx-b",
                "date": "2021-12-10"
                "otherB": "abcd"
            }
        ]
    }
}

我希望输出为:

{
    "_source": {
        "name": "xxx",
        "recall": [
            { 
                "title": "xxx-a",
                "date": "2020-12-10"
                "otherB": "abc"
            },
            { 
                "title": "xxx-b",
                "date": "2021-12-10"
                "otherB": "abcd"
            }
        ]
    }
}

我正在使用logstash将数据加载到ES。我的当前脚本如下所示:

script_lang => "painless"
script =>"if (ctx._source.containsKey('recall'))ctx._source.recall.addAll(params.event.recall);}"

但它给出的输出是将插入的文档附加到现有文档中,而不是合并:

{
    "_source": {
        "name": "xxx",
        "recall": [
            { 
                "title": "xxx-a",
                "date": "2020-12-10"
                "otherB": "abc"
            },
          [
            { 
                "title": "xxx-b",
                "date": "2021-12-10"
                "otherB": "abcd"
            }
          ]
        ]
    }
}
apeeds0o

apeeds0o1#

您只需要将脚本更改为:

script =>"if (ctx._source.containsKey('recall'))ctx._source.recall.addAll(Arrays.asList(params.event.recall));}"

相关问题