# Elasticsearch reindex using logstash

**URL:** <https://discuss.elastic.co/t/elasticsearch-reindex-using-logstash/79143>\
**Category:** Logstash\
**Created:** [March 18, 2017, 4:54pm UTC](https://discuss.elastic.co/t/elasticsearch-reindex-using-logstash/79143 "2017-03-18T16:54:06Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Srivastavark](https://avatars.discourse-cdn.com/v4/letter/s/cc9497/32.png) [@Srivastavark](https://discuss.elastic.co/u/Srivastavark)\
**Post date:** [March 18, 2017, 4:54pm UTC](https://discuss.elastic.co/t/elasticsearch-reindex-using-logstash/79143/1 "2017-03-18T16:54:06Z")

</div>

Hello experts,

I am re-indexing data using Logstash 2.3.3 from ES 1.4.4 to ES 2.4.0. I have 70000 doc type in my old index and 14000 doc type has been re-indexed in ES 2.4.0 but due to some error Logstash crashed.  
My question is

1. How to start from where log stash stopped working ?
2. Is there any way to re-index only doc type that not re-index?

My Logstash configuration

input {  
elasticsearch {  
hosts =\> "ip:9200" #source 1.4.4  
index =\> "myidex"  
query =\> '{ "query": { "match\_all": {} } }'  
scroll =\> "20m"  
docinfo =\> true  
}  
}  
filter {  
mutate{  
remove\_field =\> ["@version","@timestamp"]  
}  
}  
output {  
elasticsearch {  
hosts =\> "ip:9200" # target 2.4.0  
index =\> "%{[@metadata][\_index]}"  
document\_type =\> "%{[@metadata][\_type]}"  
document\_id =\> "%{[@metadata][\_id]}"  
}  
}

---

<div class="post-metadata">

**Author:** ![eperry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eperry/32/551_2.png) [@eperry](https://discuss.elastic.co/u/eperry)\
**Post date:** [March 18, 2017, 7:31pm UTC](https://discuss.elastic.co/t/elasticsearch-reindex-using-logstash/79143/2 "2017-03-18T19:31:58Z")

</div>

well since your using a document id it will overwrie the existing docuement. I do this with my heart beat data

but if you are just re-indexing, why not just use the internal re-indexing feature of elastic  
[https://www.elastic.co/guide/en/elasticsearch/reference/2.4/docs-reindex.html](https://www.elastic.co/guide/en/elasticsearch/reference/2.4/docs-reindex.html)

or you could even just delete the new index and start again.

---

<div class="post-metadata">

**Author:** ![Srivastavark](https://avatars.discourse-cdn.com/v4/letter/s/cc9497/32.png) [@Srivastavark](https://discuss.elastic.co/u/Srivastavark)\
**Post date:** [March 18, 2017, 9:26pm UTC](https://discuss.elastic.co/t/elasticsearch-reindex-using-logstash/79143/3 "2017-03-18T21:26:36Z")

</div>

Thanks for your response eperry ED. I am migrating data from 1.4.4 Es cluster to 2.4.0 ES cluster, i think in this case \_reindex will not help. I can start fresh also but the problem is , i have already re-indexed 3 mil document and after fresh start if any error occur then have to start once again.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 18, 2017, 9:36pm UTC](https://discuss.elastic.co/t/elasticsearch-reindex-using-logstash/79143/4 "2017-03-18T21:36:14Z")

</div>

> [@Srivastavark](#):
>
> due to some error Logstash crashed

What error?  
Have you looked at the LS logs?

---

<div class="post-metadata">

**Author:** ![Srivastavark](https://avatars.discourse-cdn.com/v4/letter/s/cc9497/32.png) [@Srivastavark](https://discuss.elastic.co/u/Srivastavark)\
**Post date:** [March 18, 2017, 9:42pm UTC](https://discuss.elastic.co/t/elasticsearch-reindex-using-logstash/79143/5 "2017-03-18T21:42:56Z")

</div>

"Attempted to send a bulk request to Elasticsearch configured at '[IP:9200]', but Elasticsearch appears to be unreachable or down!", :error\_message=\>"Connection reset", :  
Even Target IP was working fine serving search request.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 15, 2017, 9:42pm UTC](https://discuss.elastic.co/t/elasticsearch-reindex-using-logstash/79143/6 "2017-04-15T21:42:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.