stack es update-by-query cli command

Auth required

elastic stack es update-by-query --index <index> [options]

Update documents.

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

Options

--index string required

A comma-separated list of data streams, indices, and aliases to search. It supports wildcards (*). To search all data streams or indices, omit this parameter or use * or _all.

Repeatable: pass --index multiple times to supply more than one value

--[no-]allow-no-indices

A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.

--analyzer string

The analyzer to use for the query string. This parameter can be used only when the q query string parameter is specified.

--[no-]analyze-wildcard

If true, wildcard and prefix queries are analyzed. This parameter can be used only when the q query string parameter is specified.

--default-operator string

The default operator for query string query: and or or. This parameter can be used only when the q query string parameter is specified.

--df string

The field to use as default where no field prefix is given in the query string. This parameter can be used only when the q query string parameter is specified.

--expand-wildcards string

The type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. It supports comma-separated values, such as open,hidden.

Repeatable: pass --expand-wildcards multiple times to supply more than one value

--from number

Skips the specified number of documents.

--[no-]ignore-unavailable

If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.

--[no-]lenient

If true, format-based query failures (such as providing text to a numeric field) in the query string will be ignored. This parameter can be used only when the q query string parameter is specified.

--pipeline string

The ID of the pipeline to use to preprocess incoming documents. If the index has a default ingest pipeline specified, then setting the value to _none disables the default ingest pipeline for this request. If a final pipeline is configured it will always run, regardless of the value of this parameter.

--preference string

The node or shard the operation should be performed on. It is random by default.

--q string

A query in the Lucene query string syntax.

--[no-]refresh

If true, Elasticsearch refreshes affected shards to make the operation visible to search after the request completes. This is different than the update API's refresh parameter, which causes just the shard that received the request to be refreshed.

--[no-]request-cache

If true, the request cache is used for this request. It defaults to the index-level setting.

--requests-per-second number

The throttle for this request in sub-requests per second.

--routing string

A custom value used to route operations to a specific shard.

Repeatable: pass --routing multiple times to supply more than one value

--scroll string

The period to retain the search context for scrolling.

--scroll-size number

The size of the scroll request that powers the operation.

--search-timeout string

An explicit timeout for each search request. By default, there is no timeout.

--search-type string

The type of the search operation. Available options include query_then_fetch and dfs_query_then_fetch.

--slices number

The number of slices this task should be divided into.

--sort string[]

A comma-separated list of <field>:<direction> pairs.

--stats string[]

The specific tag of the request for logging and statistical purposes.

--terminate-after number

The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting. IMPORTANT: Use with caution. Elasticsearch applies this parameter to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this parameter for requests that target data streams with backing indices across multiple data tiers.

--timeout string

The period each update request waits for the following operations: dynamic mapping updates, waiting for active shards. By default, it is one minute. This guarantees Elasticsearch waits for at least the timeout before failing. The actual wait time could be longer, particularly when multiple waits occur.

--[no-]version

If true, returns the document version as part of a hit.

--[no-]version-type

Should the document increment the version number (internal) on hit or not (reindex)

--wait-for-active-shards number

The number of shard copies that must be active before proceeding with the operation. Set to all or any positive integer up to the total number of shards in the index (number_of_replicas+1). The timeout parameter controls how long each write request waits for unavailable shards to become available. Both work exactly the way they work in the bulk API.

--[no-]wait-for-completion

If true, the request blocks until the operation is complete. If false, Elasticsearch performs some preflight checks, launches the request, and returns a task ID that you can use to cancel or get the status of the task. Elasticsearch creates a record of this task as a document at .tasks/task/{taskId}.

--max-docs number