elasticsearch使用logstash通过类似联接的SQL进行更新

在elasticsearch父项和子项中创建两个索引

PUT parent/car/sedan
{
  "type": "sedan",
  "details": {
        "wheels": 4,
        "doors": 4,
        "seats": 5,
        "fuel": "gasoline"
    }
}

PUT child/toyota/corolla
{
   "color": "white",
   "type": "sedan",
   "details": {
        "wheels": 4,
        "doors": 4,
        "seats": 5,
        "fuel": "gasoline"
    }
}

通过JOIN更新SQL（我们将使用logstash对elasticsearch执行的相应SQL版本）

ELASTICSEARCH通过JOIN更新（使用logstash.conf执行logstash，如下所述）

这很有效。如果您有更好的方法实现同样的目标，请务必让我们知道

update CHILD.doors = PARENT.doors
from PARENT, CHILD 
where PARENT.type = CHILD.type

input {
  elasticsearch {
     docinfo => true
     hosts => ["127.0.0.1:9200"]
     user => "admin"
     password => "pass"
     index => "child"
     query => '{ "query": { "match": { "type": "sedan" } } }'
  }
}

filter {
  mutate {
   remove_field => ["message","@version","@timestamp"]
  }
  elasticsearch {
     hosts => ["127.0.0.1:9200"]
     user => "admin"
     password => "pass"
     index => "parent"
     query => "type:sedan"
     fields => { "details.doors" => "parent_doors"
                 "details.seats" => "parent_seats"
                 "type" => "parent_type"
               }
  }
  prune {
    whitelist_names => ["color","type", "details","parent_doors","parent_seats","parent_type"]
  }
}

output {
  stdout { 
    codec => rubydebug
  }

  elasticsearch {
     hosts => ["127.0.0.1:9200"]
     user => "admin"
     password => "pass"
     index => "%{[@metadata][_index]}"
     document_type => "%{[@metadata][_type]}"
     document_id => "%{[@metadata][_id]}"
     action => "update"
     doc_as_upsert => true
     script_lang => "painless"
     script => "if ( ctx._source.type == '%{parent_type}' ) { ctx._source.details.doors = %{parent_doors} }"
  }
}