Elasticsearch使用带params的script调用_update为何无法删除文档？

Hey there! Let's dig into why your third experiment didn't work as expected. I've dealt with similar quirks in older Elasticsearch versions, so here's the breakdown:

The Core Issue: Script Syntax Rules in ES 6.1.3 #

In Elasticsearch 6.x, there are two valid ways to define a script for operations like delete-by-query, but they don't all support params the same way:

• Single-line script string (your Experiment 1)
  This works because you're directly writing the painless logic without external parameters, e.g.:

  {
    "query": { "match_all": {} },
    "script": "ctx.op = 'delete'"
  }
  

  Elasticsearch parses this as a simple painless script and executes it correctly.

• Object-form script (your Experiment 2)
  This also works because you're using the full script object syntax, which explicitly defines the source (script logic) and can optionally include params, e.g.:

  {
    "query": { "match_all": {} },
    "script": {
      "source": "ctx.op = 'delete'"
    }
  }
  

  This is the more flexible format that supports parameter injection.

• Single-line script + separate params (your Experiment 3)
  This fails because the single-line script string syntax does NOT support a top-level params field. When you write a script as a plain string, Elasticsearch treats it as self-contained logic—it won't look for or inject values from an external params block.

The Fix for Experiment 3 #

To use parameters with your script, you need to wrap everything into the object-form script, like this:

{
  "query": { "match_all": {} },
  "script": {
    "source": "ctx.op = params.delete_action",
    "params": {
      "delete_action": "delete"
    }
  }
}

This way, Elasticsearch correctly associates the params with the script's source and injects the values as expected.

Why This Happens #

Elasticsearch 6.x introduced stricter separation between script logic and parameters for security and maintainability. The single-line string is a shorthand for simple, parameter-free scripts, while the object form is designed for more complex, parameterized use cases. Your third experiment mixed these two formats, which the parser doesn't recognize.

内容的提问来源于stack exchange，提问作者Lone Learner