Elasticsearch：如何在curl 命令中使用Painless 脚本引用嵌套字段名称

Question

我有一个轻松的脚本，可以在控制台中运行，但在curl中失败。该脚本引用了一个嵌套字段 (event.orinal)。

在 Kibana 控制台中，此语句运行良好：

ctx._source.event.remove('original')

在curl语句中，我得到这个结果：

...
"ctx._source.event.remove(original)",
"                         ^---- HERE"
]
...
"caused_by":{"type":"illegal_argument_exception","reason":"cannot resolve symbol [original]"}},"status":400}

我们有弹性订阅，但支持人员一再表示对此的帮助“超出范围”，因为curl不是弹性产品。

任何帮助将不胜感激。

完整的 cURL 请求和响应：

curl -XPOST "https://<server>:9200/<index>/_update_by_query?conflicts=proceed" -u <creds> --cacert <certpath> -H "Content-Type: application/json" -d '
{
    "script" : "ctx._source.event.remove(original)",
    "query" : {
        "exists": { "field": "event.original" }
    }
}'

{
  "error":
    {
      "root_cause":[
        {
          "type":"script_exception",
          "reason":"compile error",
          "script_stack":
            [
              "ctx._source.event.remove(original)",
              "                         ^---- HERE"
            ],
          "script":"ctx._source.event.remove(original)",
          "lang":"painless",
          "position":
              {
                "offset":25,
                "start":0,
                "end":34
              }
        }
      ],
      "type":"script_exception",
      "reason":"compile error",
      "script_stack":
        [
          "ctx._source.event.remove(original)",
          "                         ^---- HERE"
        ],
      "script":"ctx._source.event.remove(original)",
      "lang":"painless",
      "position":
        {
          "offset":25,
          "start":0,
          "end":34
        },
      "caused_by":
        {
          "type":"illegal_argument_exception",
          "reason":"cannot resolve symbol [original]"
        }
    },
  "status":400
}

Answer 1

尝试使用摄取管道。

PUT test_nested
{
  "mappings": {
    "properties": {
      "event": {
        "type": "nested"
      }
    }
  }
}

---

POST test_nested/_doc/1
{
  "event": [
    {
      "original": "nested_value_1",
      "other_field": "first_value"
    },
    {
      "original": "nested_value_2",
      "other_field": "second_value"
    }
  ]
}

---

PUT _ingest/pipeline/remove_nested_field
{
  "processors": [
    {
      "foreach": {
        "field": "event",
        "processor": {
          "remove": {
            "field": "_ingest._value.original"
          }
        },
        "ignore_failure": true
      }
    }
  ]
}

---

POST test_nested/_update_by_query?pipeline=remove_nested_field

---

GET test_nested/_search

参考：https://discuss.elastic.co/t/ingest-processor-failure-when-accessing-nested-field/144194/2