Reindexing With Logstash.md

Reindexing with Logstash can be done with the following Logstash configuration:

 input {
   # We read from the "old" index
   elasticsearch {
     hosts => ["http://<host>:<port>"]
     index => "<old_index>"
     size => 500
     scroll => "5m"
     docinfo => true
   }
 }
 
 output {
   # We write to the "new" index
   elasticsearch {
     hosts => ["http://<host>:<port>"]
     index => "<new_index>"
     document_type => "%{[@metadata][_type]}"
     document_id => "%{[@metadata][_id]}"
   }
   # We print dots to see it in action
   stdout {
     codec => "dots"
   }
 }

Replace:

• <host>:<port> with the hostname and port of a node in your Elasticsearch cluster
• Replace the <old_index> and <new_index> names

If the new index name matches an index template with the correct mapping, you're all set. If you are indexing to a completely new name, you should create a new template (i.e., copy from an existing one) and pass the template and template_name parameters to the Elasticsearch output so that the fields in the new index get the proper mappings applied (see the documentation links for details).

If you only want to reindex a particular document type (i.e., to split different types into separate indices), then you should add a query parameter to the Elasticsearch input like the following:

query => '{ "query": { "type": { "value": "my_type" } } }'

Where my_type is the document type you wish to reindex.