How can I download index "Fields" frome one ES and upload it to another?
I would like not to direct copy between instances, but store it as some config to use in many ES which don't have connection between another instances.
Just to be clear, you don't want the data, just the mapping?
Yes, exactly 
The look at the _mapping API endpoint
Can you please share little more details? To be honest I am every new in ELK Stack. Not sure how do this, if I need/can do only curl query to download and upload? If yes, can you give me please example of such curl commands to download and upload? Thanks!
No worries!
You will want to run curl -XGET ESHOST:9200/INDEXNAME/_mapping, replace ESHOST with one of the nodes and INDEXNAME with the index you want the mapping of.
If you need to use a username and password, then add -u username:password before the -XGET.
Thanks, I will sounds lame but my index have asterix ("test-*")... so I guess i can't just use name and this is reason why I got 404. I am using correct address/port. I tried use ID from URL which I got when loading this fields list but looks like this is not how it can works.
Additional question, how load/push later this mapping to another ES with curl?
Can you post the command you ran and the full output?
Please also remember to format your code/logs/config using the </> button, or markdown style back ticks. It helps to make things easy to read which helps us help you
Actually it started working with *, not sure, maybe made some mistake last time, thanks!
How can I upload this json as 'index pattern' (test-* because my indexes have names for each day like test-2020-04-02 etc) to another elasticsearch?
Accually due export it making also indexes per day, but will it work as index patern for all, incuding future indexes? also is this good to make indexes per day or should I have one general?
I am using it for selected network protocols and currently I have 920 fields (from 1000 afair). BTW, should I refresh this fields in index pattern menu from time to time? It change something (like elastic work faster due analysis of it etc) or this is just about load this list of fields to just show me all fields from indexes which match pattern?
I guess I can 'exclude' some fields from indexing in patterns etc. Will it speed up something or it don't change anything in matter that make it sense to bother about that number of fields?
Try curl -XPUT ESHOST:9200/NEWINDEXNAME -d @mappingfile.json
Check out the documentation too, it has practical examples using Kibana Dev Tools, or you can copy them as curl commands
If you want the mapping to apply to more than one index, then take a look at index templates,
You don't need to refresh the index mapping in Kibana settings unless you make a mapping change in Elasticsearch.
Excluding fields can improve performance, but if it's only a few then it may not be worth it.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.