elasticsearch update by JOIN like SQL using logstash - sql

Question

Create two indices in elasticsearch parent and child
PUT parent/car/sedan
{
"type": "sedan",
"details": {
"wheels": 4,
"doors": 4,
"seats": 5,
"fuel": "gasoline"
}
}
PUT child/toyota/corolla
{
"color": "white",
"type": "sedan",
"details": {
"wheels": 4,
"doors": 4,
"seats": 5,
"fuel": "gasoline"
}
}
SQL UPDATE by JOIN (the corresponding SQL version that we'll perform on elasticsearch using logstash)
update CHILD.doors = PARENT.doors
from PARENT, CHILD
where PARENT.type = CHILD.type
ELASTICSEARCH UPDATE by JOIN (execute logstash with the logstash.conf as mentioned below)
input {
elasticsearch {
docinfo => true
hosts => ["127.0.0.1:9200"]
user => "admin"
password => "pass"
index => "child"
query => '{ "query": { "match": { "type": "sedan" } } }'
}
}
filter {
mutate {
remove_field => ["message","#version","#timestamp"]
}
elasticsearch {
hosts => ["127.0.0.1:9200"]
user => "admin"
password => "pass"
index => "parent"
query => "type:sedan"
fields => { "details.doors" => "parent_doors"
"details.seats" => "parent_seats"
"type" => "parent_type"
}
}
prune {
whitelist_names => ["color","type", "details","parent_doors","parent_seats","parent_type"]
}
}
output {
stdout {
codec => rubydebug
}
elasticsearch {
hosts => ["127.0.0.1:9200"]
user => "admin"
password => "pass"
index => "%{[#metadata][_index]}"
document_type => "%{[#metadata][_type]}"
document_id => "%{[#metadata][_id]}"
action => "update"
doc_as_upsert => true
script_lang => "painless"
script => "if ( ctx._source.type == '%{parent_type}' ) { ctx._source.details.doors = %{parent_doors} }"
}
}
This Works. If you have a better way of achieving the same, please do let us know.