How to convert Elasticsearch index field of string type to json?

Question

I have an Opensearch index with a string field message defined as below:

{"name":"message.message","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false}

Sample data:

"_source" : {
          "message" : {
            "message" : "user: AB, from: home, to: /app1"
          }
        }

I would like to convert the message column into json so that I can access the values message.user, message.from and message.to individually.

How do I go about it?

Answer 1

You can use Json Processor.

POST /_ingest/pipeline/_simulate
{
  "pipeline": {
    "description": "convert json to object",
    "processors": [
      {
        "json": {
          "field": "foo",
          "target_field": "json_target"
        }
      }
    ]
  },
  "docs": [
    {
      "_index": "index",
      "_id": "id",
      "_source": {
        "foo": "{\"name\":\"message.message\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false}\r\n"
      }
    }
  ]
}

Response:

{
  "docs": [
    {
      "doc": {
        "_index": "index",
        "_id": "id",
        "_version": "-3",
        "_source": {
          "foo": """{"name":"message.message","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false}
""",
          "json_target": {
            "esTypes": [
              "text"
            ],
            "readFromDocValues": false,
            "name": "message.message",
            "count": 0,
            "aggregatable": false,
            "type": "string",
            "scripted": false,
            "searchable": true
          }
        },
        "_ingest": {
          "timestamp": "2022-11-09T19:38:01.16232Z"
        }
      }
    }
  ]
}