Creating an index with existing index

Hello,

I have many indexes named

.ds-traces-apm-default-2022.12.12-000124
.ds-traces-apm-default-2022.12.17-000125
.ds-traces-apm-default-2022.12.20-000126
.ds-traces-apm-default-2022.12.22-000127
.ds-traces-apm-default-2023.01.04-000139

and they have a,b,c,d,e,f,g,h etc columns.
I am trying to create a new index that would have a, b, c columns/fields from the first index only if they satisfy condition. Is it possible to do that?

{
 "source": {
   "index": ".ds-traces-apm-default-*",
 "query": {
   "match_phrase": {
     "url.path": "/TicketCheckerServices/v2/ticketInquiry"
   }
 }
 },
 "dest": { 
   "index": "test1"
   }
}```

With this I am getting an error 

```{
 "error": {
   "root_cause": [
     {
       "type": "parse_exception",
       "reason": "request body is required"
     }
   ],
   "type": "parse_exception",
   "reason": "request body is required"
 },
 "status": 400
}```

Actually I figured it out myself.
You can do it by specifying the _source filter. for example

 "source": {
   "index": ".ds-traces-apm-default-*",
   "_source" : ["sourceindexfieldname1", "sourceindexfieldname2", ...],
 "query": {
   "match_phrase": {
     "url.path": "/TicketCheckerServices/v2/ticketInquiry"
   }
 }
 },
 "dest": { 
   "index": "test1"
   }
}```

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.