Use the Elasticsearch _update API to change one existing document without sending separate client requests to fetch, modify, and index it again. It can add fields, replace field values, or replace a document; for many matching documents, use _update_by_query instead. section 5.4 section 5.8
An update is internally a fetch-modify-reindex sequence on the same shard. Elasticsearch creates a newer document version, marks the older version for deletion, and increments the version when the operation completes. Keeping these steps on the shard avoids client-server round trips, network traffic, and opportunities for client-side coding errors. section 5.4.1
Follow the fetch, modify, and reindex flow behind a document update. section 5.4.1
Send a POST request to <index>/_update/<id>. Put direct field changes inside a doc object. Adding fields assumes dynamic mapping is enabled; changing an array by this method requires sending its old entries together with the new one, because the supplied array replaces the prior array. section 5.4.2
Add movie metadata
Add actors and a director to movie document 1 by wrapping the new fields in doc: POST movies/_update/1 { "doc": { "actors": ["Marlon Brando", "Al Pacino", "James Caan"], "director": "Francis Ford Coppola" } } Use the same shape to change title to "The Godfather (Original)." section 5.4.2
Use a script when an update depends on existing source values or conditions. Scripts access fields through ctx._source, so they can append an actor, remove an array element by its index, add or remove fields, or set blockbuster according to box-office earnings. Pass changing values through params rather than embedding them in the condition. section 5.4.3
Append an actor without resending the array
A scripted update can add Diane Keaton directly to the existing actors array: POST movies/_update/1 { "script": { "source": "ctx._source.actors.add('Diane Keaton')" } } section 5.4.3
For a single-document update, use POST with the index and document ID. Avoid the _doc form of the update URL: types were deprecated and removed in version 8. Use _bulk for batched document operations when appropriate. section 5.4.2 section 5.8
