Deleting a field from a document in Elasticsearch

In Elasticsearch, it is a common requirement to delete a field from a document. This can be useful when you want to remove unnecessary or outdated information from your index. In this article, we will discuss different methods to delete a field from a document in Elasticsearch, along with examples and step-by-step instructions.

Method 1: Using the Update API

The Update API allows you to update a document by providing a script that modifies the document’s source. You can use this API to delete a field from a document by setting the field to null. Here’s a step-by-step guide on how to do this:

1. Identify the index, document type (if using Elasticsearch 6.x or earlier), and document ID of the document you want to update.

2. Use the Update API with a script that sets the field to null, or even better, removes it from the source document. The following example demonstrates how to delete the “field_to_delete” field from a document with ID “1” in the “my_index” index:

POST /my_index/_update/1
{
  "script": "ctx._source.remove('field_to_delete')"
}

3. Execute the request. If successful, Elasticsearch will return a response indicating that the document has been updated.

Note: This method only removes the field from the specified document. The field will still exist in the mapping and other documents in the index.

Method 2: Reindexing with a Modified Source

If you want to delete a field from all documents in an index, you can use the Reindex API to create a new index with the modified source. Here’s how to do this:

1. Create a new index with the same settings and mappings as the original index. You can use the Get Index API to retrieve the settings and mappings of the original index.

2. Use the Reindex API to copy documents from the original index to the new index, while removing the field from the source. The following example demonstrates how to delete the “field_to_delete” field from all documents in the “my_index” index:

POST /_reindex
{
  "source": {
    "index": "my_index"
  },
  "dest": {
    "index": "new_index"
  },
  "script": {
    "source": "ctx._source.remove('field_to_delete')"
  }
}

3. Verify that the new index contains the correct documents with the field removed.

4. If everything looks good, you can delete the original index and, if necessary, add an alias to the new index having the name of the original index name.

Method 3: Updating the Mapping and Reindexing

If you want to delete a field from the mapping and all documents in an index, you can update the mapping and then reindex the documents. Here’s how to do this:

1. Create a new index with the same settings as the original index.

2. Retrieve the mappings of the original index using the Get Mapping API.

3. Modify the mappings by removing the field you want to delete.

4. Apply the modified mappings to the new index using the Put Mapping API.

5. Use the Reindex API to copy documents from the original index to the new index, as described in Method 2.

6. Verify that the new index contains the correct documents with the field removed and that the field is not present in the mapping.

7. If everything looks good, you can delete the original index and, if necessary, add an alias to the new index having the name of the original index name.

Conclusion

In this article, we discussed three methods to delete a field from a document in Elasticsearch: using the Update API, reindexing with a modified source, and updating the mapping and reindexing. Each method has its own use cases and trade-offs, so choose the one that best fits your requirements. Always remember to test your changes and verify the results before applying them to production environments.

Ready to try this out on your own? Start a free trial.

Want to get Elastic certified? Find out when the next Elasticsearch Engineer training is running!