elasticsearch - ElasticSearch在文档中移动节点

Question

我有多个文档，其中包含嵌套的对象。我需要在文档中移动嵌套对象的位置。

在下面的示例中，我要如何做到这一点，例如将用户移出组:

{
  "resourceGroup": "",
  "abc": "Ok",
  "firstSeen": "2020-03-16T08:45:02.444Z",
  "entityId": "29e7d555-1959-4b9b-b663-ce0d04f3e5a7",
  "type": "GroupEntity",
  "group": {
    "onPremisesProvisioningErrors": ,
    "mailNickname": "74b06328-1",
    "users": [
      {
        "mail": "abc@aaa.com",
        "mailNickname": "sdf"
      },
      {
        "displayName": "test user",
        "mailNickname": "testuser1"
      }
    ],

  }
}

Answer 1

您可以使用ingest node

Use an ingest node to pre-process documents before the actual document indexing happens. The ingest node intercepts bulk and index requests, it applies transformations, and it then passes the documents back to the index or bulk APIs.

样本映射

PUT index54
{
  "mappings": {
    "properties": {
      "resourceGroup": {
        "type": "text"
      },
      "group": {
        "type": "object",
        "properties": {
          "users": {
            "type": "nested",
            "properties": {
              "mail": {
                "type": "text"
              },
              "mailNickname": {
                "type": "text"
              }
            }
          }
        }
      }
    }
  }
}

摄取管道

PUT _ingest/pipeline/moveuserspropertypipeline
{
  "description" : "move users out of group",
  "processors" : [
    {
      "set" : {
        "field": "users",
        "value": "{{group.users}}"
      }
    },
    {
      "remove": {
        "field": "group.users"
      }
    }
  ]
}

使用 reindex API可以将文档从源索引复制到新索引。
在执行重新索引API之前，使用正确的映射创建目标索引

POST _reindex
{
  "source": {
    "index": "index54"
  },
  "dest": {
    "index": "index55",
    "pipeline": "moveuserspropertypipeline"
  }
}