By accident i inserted some values inside an index as an array with a single value, instead of inserting it as a single string.

For example: Instead of inserting "This string" i inserted ["This string"]

I need to find the values that have been inserted in the ["String"] case so that i can update them the way they should be, the normal "String".

The index mapping for the field is a keyword and i can't really seem to a query that finds the values that are arrays.

I can't really delete the index and start over since there is a lot of data in it.

Let's say the index has this mapping:

{
  "mappings": {
    "_doc": {
      "properties": {
        "url": {
          "type": "keyword"
        }      
      }
    }
  }
}

And i inserted two values

PUT <index>/_doc
{
  "url": "google.com"
}

PUT <index>/_doc
{
  "url": ["google.com"]
}

How can i find the documents that are like the second document that are an array of a single value?

Note: This is with elasticsearch version 7.13.1

CodePudding user response：

Try the script filter

GET <index>/_search
{
  "query": {
    "bool": {
      "filter": {
        "script": {
          "script": "params._source.url instanceof List"
        }
      }
    }
  }
}

CodePudding user response：

Elasticsearch doesn't have a dedicated array data type, so "string" and ["string"] are equivalent.

The following query will find both of your documents.

{
  "query": {
    "term": {
      "url": "google.com"
    }
  }
}

So, to be fair, you don't need to do anything unless it matters for the application that would later consume the search results and actually expect a string instead of array.