POST /index/_update_by_query
{
  "script": "ctx._source.field = 'correct value'",
  "query": {
    "term": {
      "field": "wrong value"
    }
  }
}

$ grep backup /srv/elk/elasticsearch/config/elasticsearch.yml
path.repo: [ "/backup" ]

PUT /_snapshot/backup
{
  "type": "fs",
  "settings": {
    "location": "/backup",
    "compress": "true"
  }
}