# Datastream : reindex an indice

**URL:** <https://discuss.elastic.co/t/datastream-reindex-an-indice/376571>\
**Category:** Elasticsearch\
**Created:** [March 31, 2025, 7:19am UTC](https://discuss.elastic.co/t/datastream-reindex-an-indice/376571 "2025-03-31T07:19:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sbocquet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sbocquet/32/105594_2.png) [@sbocquet](https://discuss.elastic.co/u/sbocquet)\
**Post date:** [March 31, 2025, 7:19am UTC](https://discuss.elastic.co/t/datastream-reindex-an-indice/376571/1 "2025-03-31T07:19:04Z")

</div>

Hi,

I have a datastream named "logs-local1-default" that have 3 indices:

- .ds-logs-local1-default-2024.12.11-000001
- .ds-logs-local1-default-2025.02.15-000002
- .ds-logs-local1-default-2025.03.25-000003

One (the second one) need to be reindexed because 2 fields were not detected correctly (string vs integer).

I already tried to reindex the indice using logstash with this script:

```auto
input {
    elasticsearch {
        hosts => "https://elk.myserver.fr:9200"
        index => ".ds-logs-local1-default-2025.02.15-000002"
        ssl_enabled => true
        ssl_truststore_path => "/etc/logstash/certs/elastic-stack-ca.p12"
        ssl_truststore_password => "myPassword"
        ssl_keystore_path => "/etc/logstash/certs/http.p12"
        ssl_keystore_password => "myPassword"
        user => "logstash_writer"
        password => "logstash"
        size => 1000
        scroll => "5m"
        docinfo => true
    }
}

output {
    elasticsearch {
        hosts => "https://elk.myserver.fr:9200"
        index => ".ds-logs-local1-default-2025.02.14-000002"
        ssl_enabled => true
        ssl_truststore_path => "/etc/logstash/certs/elastic-stack-ca.p12"
        ssl_truststore_password => "myPassword"
        ssl_keystore_path => "/etc/logstash/certs/http.p12"
        ssl_keystore_password => "myPassword"
        user => "logstash_writer"
        password => "logstash"
    }

    stdout {
        codec => "dots"
    }
}

```

The new indice was created with the correct fields but I don't know how to "add" it to the datastream.

Or is there another way to do it ?  
What's the best way ?

Any advice is welcome.

Thanks

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [March 31, 2025, 8:25am UTC](https://discuss.elastic.co/t/datastream-reindex-an-indice/376571/2 "2025-03-31T08:25:06Z")

</div>

Is

> **[Modify data streams API | Elasticsearch Guide \[8.17\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/modify-data-streams-api.html)**

What you are looking for?

---

<div class="post-metadata">

**Author:** ![sbocquet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sbocquet/32/105594_2.png) [@sbocquet](https://discuss.elastic.co/u/sbocquet)\
**Post date:** [March 31, 2025, 8:38am UTC](https://discuss.elastic.co/t/datastream-reindex-an-indice/376571/3 "2025-03-31T08:38:05Z")

</div>

Perfect !

Thanks a lot.

---

<div class="post-metadata">

**Author:** ![Keith\_Massey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/keith_massey/32/83666_2.png) [@Keith\_Massey](https://discuss.elastic.co/u/Keith_Massey)\
**Post date:** [March 31, 2025, 9:04pm UTC](https://discuss.elastic.co/t/datastream-reindex-an-indice/376571/4 "2025-03-31T21:04:30Z")

</div>

If you are using ILM, you'll also want to copy over the `index.lifecycle.name` setting. Unfortunately though, the ILM state for the index is kept in the cluster state (an internal elasticsearch data structure), which makes it pretty difficult to copy over to the new index.  
It doesn't help you in your current situation, but we have recently added [an API to reindex old indices within a data stream](https://www.elastic.co/guide/en/elasticsearch/reference/8.18/data-stream-reindex-api.html) to assist with upgrades. There are more edge cases than you would expect. It's possible that that API could be expanded in the future to cover he more general use case you have. But there are no concrete plans for that right now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 28, 2025, 9:04pm UTC](https://discuss.elastic.co/t/datastream-reindex-an-indice/376571/5 "2025-04-28T21:04:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.