Reindexing with Logstash can be done with the following Logstash configuration:
input {
# We read from the "old" index
elasticsearch {
hosts => ["http://<host>:<port>"]
index => "<old_index>"
size => 500
scroll => "5m"
docinfo => true
}
}
output {
# We write to the "new" index
elasticsearch {
hosts => ["http://<host>:<port>"]
index => "<new_index>"
document_type => "%{[@metadata][_type]}"
document_id => "%{[@metadata][_id]}"
}
# We print dots to see it in action
stdout {
codec => "dots"
}
}
Replace:
<host>:<port>
with the hostname and port of a node in your Elasticsearch cluster- Replace the
<old_index>
and<new_index>
names
If the new index name matches an index template with the correct mapping, you're all set. If you are indexing to a completely new name, you should create a new template (i.e., copy from an existing one) and pass the template and template_name parameters to the Elasticsearch output so that the fields in the new index get the proper mappings applied (see the documentation links for details).
If you only want to reindex a particular document type (i.e., to split different types into separate indices), then you should add a query parameter to the Elasticsearch input like the following:
query => '{ "query": { "type": { "value": "my_type" } } }'
Where my_type
is the document type you wish to reindex.