# Creating a second index with subset of fields from first index

**URL:** <https://discuss.elastic.co/t/creating-a-second-index-with-subset-of-fields-from-first-index/353265>\
**Category:** Elasticsearch\
**Created:** [February 14, 2024, 11:38am UTC](https://discuss.elastic.co/t/creating-a-second-index-with-subset-of-fields-from-first-index/353265 "2024-02-14T11:38:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [February 14, 2024, 11:38am UTC](https://discuss.elastic.co/t/creating-a-second-index-with-subset-of-fields-from-first-index/353265/1 "2024-02-14T11:38:33Z")

</div>

Hello Elastic community,

I'm seeking advice on how to efficiently create a second index containing only a subset of fields from a primary index based on certain conditions.

To provide some context, let's say I have a primary index containing documents with 10 fields. However, I'm interested in creating a secondary index that includes only two specific fields (e.g., client IP and client MAC) from the primary index, under the condition that both of these fields exist in the document.

It's important to note that I'm unable to use Logstash for this task due to certain constraints.

Essentially, when a particular condition is met (e.g., both client IP and client MAC fields exist), I'd like to write a document to the secondary index with only these two fields.

I'd appreciate any advice or suggestions on how to approach this task efficiently using Elasticsearch.

Thank you in advance for your help and insights!

Best regards

---

<div class="post-metadata">

**Author:** ![RabBit\_BR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rabbit_br/32/82261_2.png) [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\
**Post date:** [February 14, 2024, 2:52pm UTC](https://discuss.elastic.co/t/creating-a-second-index-with-subset-of-fields-from-first-index/353265/2 "2024-02-14T14:52:17Z")

</div>

Hi @yago82

Did you try with [Reindex select fields with a source filter](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html#docs-reindex-filter-source).

```auto
POST _reindex
{
  "source": {
    "index": "my-index-000001",
    "_source": ["user.id", "_doc"]
  },
  "dest": {
    "index": "my-new-index-000001"
  }
}

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 14, 2024, 4:15pm UTC](https://discuss.elastic.co/t/creating-a-second-index-with-subset-of-fields-from-first-index/353265/3 "2024-02-14T16:15:55Z")

</div>

The easiest way to do that is during indexing, so this could be easily done if you were using Logstash.

Without Logstash you may be able to do that using [transforms](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html).

With transform you can create a search in discovery with your condition, and use this search as the data source for your transform.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 13, 2024, 4:16pm UTC](https://discuss.elastic.co/t/creating-a-second-index-with-subset-of-fields-from-first-index/353265/4 "2024-03-13T16:16:45Z")

</div>

Closed on March 13, 2024, 4:16pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.