Content type errors when reindexing

Elastic Stack Elasticsearch
1

Hi

I am trying to reindex from a remote host

I am running this command -

curl -X POST "http://localhost:9200/_reindex" -H 'Content-Type: application/json' -d'
{
"source": {
"remote": {
"host": "http://remoteip:9200"
},
"index": "mylogs-2019.06.17" <---- Remote cluster index
},
"dest": {
"index": "mylogs-2019.06.17" <---- Local Index
}
}'
{"error":{"root_cause":[{"type":"x_content_parse_exception","reason":"[7:18] [reindex] failed to parse field [source]"}],"type":"x_content_parse_exception","reason":"[7:18] [reindex] failed to parse field [source]","caused_by":{"type":"json_parse_exception","reason":"Unexpected character ('<' (code 60)): was expecting comma to separate Object entries\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@58cd6dfa; line: 7, column: 49]"}},"status":400}

Can anyone advise how to fix this? Ive tried content type text/plain but apparently this is not supported.

2

Remove <---- Remote cluster index and the other one.

3

well, thats embarrassing.

Thank you for noticing that.

4

I have another question re reindexing.

If I am reindexing from a single node ELK stack to a Multi-node Elastic search cluster.

Which node on the elastic search cluster do I do this from?, One of the dedicated master nodes, or one of the dedicated data nodes?

Obviously I want the data I am reindexing to be spread out across the cluster, and not just dumped onto one of the nodes, is this a concern, or will elasticsearch just do this naturally?

5

It will do it naturally unless you have only one shard.

6

OK Thanks.

So it doesnt matter which node I run the command on? Would it be best to do this on a dedicated master, or dedicated data?

7

It's better to run it on a node which is not overloaded.