Duplicate an elasticsearch index with logstash

dup_elastic_index.md

I wanted to copy an index in my elasticsearch DB, so I could try and re-open it in Kibana whilst ticking the 'not a time series database' option. So, how to copy an index??

I found a useful post at http://david.pilato.fr/blog/2015/05/20/reindex-elasticsearch-with-logstash/ That copies an index from one elastic to another, and is written for an older version of logstash. Updating that to logstash ~7.3 and modifying to copy an index to a new index of a different name in the same DB, I came up with:

# Logstash config to copy one index to another

input {
  # We read from the "old" cluster
  elasticsearch {
    hosts => "192.168.0.111:9200" 
    index => "logtest"
    size => 500
    scroll => "5m"
    docinfo => true
  }
}

output {
  # We write to the "new" cluster
  elasticsearch {
    hosts => "192.168.0.111:9200"
    index => "test"
    document_id => "%{[@metadata][_id]}"
  }
  # We print dots to see it in action
  stdout {
    codec => "dots"
  }
}

and to invoke it:

#!/bin/bash

set -x

sudo /usr/share/logstash/bin/logstash -f copy.conf

I can see a copy - now, to check if I have data!