ElasticSearch - Update multiple documents at once with a WHERE clause

Question

ElasticSearch 6.2.2 on Linux - all activity achieved via API calls - we don't have Kibana set up.

I am trying to update one field of approximately 5,000 documents to be the same value. Right now I only know how to update one document at a time, using the following API call:

Url:

POST http://{{elasticip}}:9200/{{index}}/_doc/{{docid}}/_update?pretty

Body:

{
  "doc": { "categories": [ "NEWS" ]}
}

I have approximately 5k documents with a categories value of null. So I need to do an update API call that says update all documents where categories field is null with value [ "NEWS" ].

Is this achievable via API call?

Answer 1

This can be achieved using the update by query API:

POST your-index/_update_by_query
{
  "script": {
    "source": "ctx._source.categories = params.categories",
    "lang": "painless",
    "params": {
      "categories": ["NEWS"]
    }
  },
  "query": {
    "bool": {
      "must_not": {
        "exists": {
          "field": "categories"
        }
      }
    }
  }
}