Best way to reindex text to keyword

Elastic Stack Elasticsearch
1

I want to re-index a text field to keyword.
I have multiple indices (myindex-000001, myindex-000002, etc)

In order to reindex I must: a) get the mapping b) create a new index mynewindex-000001 same field name but different type (text->keyword).

Then repeat the procedure for all indices.
Is this logic correct?

Here is the index mapping ( I want to change host,path and tags to type "keyword")

{
  "myindex-000001" : {
    "mappings" : {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "@version" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "host" : {
          "type" : "text"
        },
        "message" : {
          "type" : "text"
        },
        "path" : {
          "type" : "text"
        },
        "tags" : {
          "type" : "text"
        },
        "timestamp" : {
          "type" : "date"
        },
        "version" : {
          "type" : "text"
        }
      }
    }
  }
}
2

Hi @Mark_S
I would do it that way. I would create the new index with the keyword type in the correct fields and use the Api reindex. I don't know if you use Alias ​​but I would also start applying it to the indexes to facilitate migration.

3

You should be able to do this with the reindex API as it uses _source, which you haven't disabled. Then define the new mapping as per your requirements.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.