3

I want to define a field in the mapping e.g. modified_datetime that will hold datetime value as to when the document is created/modified. Is there a way to define this in elasticsearch such that it is populated automatically by elasticsearch just like we can set default sysdate in Oracle?

Maarab
  • 143
  • 1
  • 14
  • There's `null_value` but I didn't manage it to work with dates. How are you indexing the date? Maybe you could add the date there. An alternative approach is to use a script which will handle that, I will post in the answer – aclowkay Sep 23 '18 at 09:12
  • Indexing the documents through kafka connectors but the document message is created even before so the change would have to be done there. That would fail the purpose of having it done exactly at the time of ingestion. That is why I was looking for the default automatic option. – Maarab Sep 23 '18 at 10:43

2 Answers2

0

In the previous versions of Elasticsearch there was a _timestamp field that seemed to meet your requirements. But now it is removed from the latest versions and as documentation states you should

use a normal date field and set its value explicitly

briarheart
  • 1,906
  • 2
  • 19
  • 33
  • I did come across the option and am surprised it is removed. Setting to value explicitly is always an option. I wanted to keep it for last. – Maarab Sep 23 '18 at 10:45
0

There is no setting for default value in ElasticSearch. However, you could workaround this prior to ingestion, in either your data pipeline, or in rest API similar to this Find and replace in elasticsearch all documents

aclowkay
  • 3,577
  • 5
  • 35
  • 66
  • From what I understand update_by_query is used to work on documents that are already there in the index right? – Maarab Sep 23 '18 at 10:48