# Exporting data from one elk cluster to another elk cluster

**URL:** <https://discuss.elastic.co/t/exporting-data-from-one-elk-cluster-to-another-elk-cluster/62433>\
**Category:** Logstash\
**Created:** [October 6, 2016, 8:07pm UTC](https://discuss.elastic.co/t/exporting-data-from-one-elk-cluster-to-another-elk-cluster/62433 "2016-10-06T20:07:21Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![shankarbala](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@shankarbala](https://discuss.elastic.co/u/shankarbala)\
**Post date:** [October 6, 2016, 8:07pm UTC](https://discuss.elastic.co/t/exporting-data-from-one-elk-cluster-to-another-elk-cluster/62433/1 "2016-10-06T20:07:22Z")

</div>

HI

i am trying to import data from one elk cluster to another elk cluster using logstash..but it gives error as below..(i am using logstash 2.4)..here is the logstash conf

input {  
elasticsearch {  
hosts =\> ["old\_cluster\_ip:9200"]  
index =\> "lob\*"  
query =\> "\*"  
size =\> 500  
scroll =\> "5m"  
docinfo =\> true  
}  
}  
output {  
elasticsearch {  
hosts =\> ["new\_cluster\_ip:9200", "new\_cluster\_ip:9200"]  
index =\> "%{[@metadata][\_index]}"  
document\_type =\> "%{[@metadata][\_type]}"  
document\_id =\> "%{[@metadata][\_id]}"  
}  
}

{:timestamp=\>"2016-10-06T12:05:10.104000-0700", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \<LogStash::Inputs::Elasticsearch hosts=\>["old\_cluster\_ip:9200"], index=\>"lob\*", query=\>"\*", codec=\>\<LogStash::Codecs::JSON charset=\>"UTF-8"\>, scan=\>true, size=\>1000, scroll=\>"1m", docinfo=\>false, docinfo\_target=\>"@metadata", docinfo\_fields=\>["\_index", "\_type", "\_id"], ssl=\>false\>\n Error: [400] {"error":{"root\_cause":[{"type":"parse\_exception","reason":"Failed to derive xcontent"}],"type":"search\_phase\_execution\_exception","reason":"all shards failed","phase":"init\_scan","grouped":true,"failed\_shards":[{"shard":0,"index":"lob20160630","node":"s4l2VJIsRvewpSYdnPZ8mQ","reason":{"type":"parse\_exception","reason":"Failed to derive xcontent"}}]},"status":400}", :level=\>:error}

any idea why this error is happening ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 7, 2016, 3:53am UTC](https://discuss.elastic.co/t/exporting-data-from-one-elk-cluster-to-another-elk-cluster/62433/2 "2016-10-07T03:53:51Z")

</div>

Are both the same version? Check the ES logs, there's a 400 error there that should show something.

---

<div class="post-metadata">

**Author:** ![shankarbala](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@shankarbala](https://discuss.elastic.co/u/shankarbala)\
**Post date:** [October 7, 2016, 6:14am UTC](https://discuss.elastic.co/t/exporting-data-from-one-elk-cluster-to-another-elk-cluster/62433/3 "2016-10-07T06:14:21Z")

</div>

source elk cluster is @ 2.1.0 and destiination elk is @ 2.2.0..is that a problem ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 7, 2016, 7:07am UTC](https://discuss.elastic.co/t/exporting-data-from-one-elk-cluster-to-another-elk-cluster/62433/4 "2016-10-07T07:07:45Z")

</div>

No that's fine.

---

<div class="post-metadata">

**Author:** ![shankarbala](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@shankarbala](https://discuss.elastic.co/u/shankarbala)\
**Post date:** [October 7, 2016, 5:49pm UTC](https://discuss.elastic.co/t/exporting-data-from-one-elk-cluster-to-another-elk-cluster/62433/5 "2016-10-07T17:49:02Z")

</div>

seeing the below error in es logs at source side

[2016-10-07 10:41:54,777][DEBUG][action.search.type] [elkstack1-cc] [lob20160913][4], node[s4l2VJIsRvewpSYdnPZ8mQ], [P], v[2], s[STARTED], a[id=BNwOlmwjRyesSsrFQV-cOg]: Failed to execute [org.elasticsearch.action.search.SearchRequest@705d939a] lastShard [true]  
RemoteTransportException[[elkstack1-cc][:9300][indices:data/read/search[phase/scan]]]; nested: SearchParseException[failed to parse search source [_na_]]; nested: ElasticsearchParseException[Failed to derive xcontent];  
Caused by: SearchParseException[failed to parse search source [_na_]]; nested: ElasticsearchParseException[Failed to derive xcontent];  
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:848)  
at org.elasticsearch.search.SearchService.createContext(SearchService.java:651)  
at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:617)  
at org.elasticsearch.search.SearchService.executeScan(SearchService.java:279)

any clue why its happening ?

---

<div class="post-metadata">

**Author:** ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)\
**Post date:** [October 7, 2016, 9:05pm UTC](https://discuss.elastic.co/t/exporting-data-from-one-elk-cluster-to-another-elk-cluster/62433/6 "2016-10-07T21:05:47Z")

</div>

Hello shankarbala,

Maybe you could use `output { stdout { codec => rubydebug } } }` instead of the current elasticsearch output so we can get a better idea of what is being read from the source elasticsearch.

Cheers.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:35am UTC](https://discuss.elastic.co/t/exporting-data-from-one-elk-cluster-to-another-elk-cluster/62433/7 "2017-07-06T04:35:06Z")

</div>