transform.md

transform.md

DELETE after,before


PUT before/
{
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "bg_group_name": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      }
    }
  }
}


POST before/_doc/1
{
  "@timestamp": "2023-08-22T12:00:00.000Z",
  "bg_group_name": "BG001"
}


PUT _index_template/summary
{
  "template": {
    "mappings": {
      "properties": {
        "company_classification": {
          "type": "text",
          "fields": {
            "keyword": {
              "ignore_above": 256,
              "type": "keyword"
            }
          }
        },
        "bg_group_name": {
          "type": "text",
          "fields": {
            "keyword": {
              "ignore_above": 256,
              "type": "keyword"
            }
          }
        }
      }
    }
  },
  "index_patterns": [
    "after*"
  ],
  "composed_of": []
}



PUT _transform/summary
{
  "source": {
    "index": [
      "before"
    ],
    "query": {
      "match_all": {}
    }
  },
  "dest": {
    "index": "after"
  },
  "pivot": {
    "group_by": {
      "@timestamp": {
        "date_histogram": {
          "field": "@timestamp",
          "calendar_interval": "1d"
        }
      },
      "bg_group_name": {
        "terms": {
          "field": "bg_group_name.keyword"
        }
      },
      "measure": {
        "terms": {
          "field": "measure"
        }
      }
    },
    "aggregations": {
      "ASM_優先度1.sum": {
        "sum": {
          "field": "ASM_優先度1"
        }
      }
    }
  }
}
  
POST _transform/summary/_start

GET before/_mapping/field/bg_group_name
GET after/_mapping/field/bg_group_name

• response

# GET before/_mapping/field/bg_group_name 200 OK
{
  "before": {
    "mappings": {
      "bg_group_name": {
        "full_name": "bg_group_name",
        "mapping": {
          "bg_group_name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      }
    }
  }
}
# GET after/_mapping/field/bg_group_name 200 OK
{
  "after": {
    "mappings": {
      "bg_group_name": {
        "full_name": "bg_group_name",
        "mapping": {
          "bg_group_name": {
            "type": "keyword"
          }
        }
      }
    }
  }
}

• when index is already created, the mapping can be preserved.

DELETE after
PUT after/
{
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "bg_group_name": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      }
    }
  }
}
POST _transform/summary/_start

GET before/_mapping/field/bg_group_name
GET after/_mapping/field/bg_group_name

# GET before/_mapping/field/bg_group_name 200 OK
{
  "before": {
    "mappings": {
      "bg_group_name": {
        "full_name": "bg_group_name",
        "mapping": {
          "bg_group_name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      }
    }
  }
}
# GET after/_mapping/field/bg_group_name 200 OK
{
  "after": {
    "mappings": {
      "bg_group_name": {
        "full_name": "bg_group_name",
        "mapping": {
          "bg_group_name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      }
    }
  }
}