How to "recreate" events from an index by just changing time?

We have some "enriched" events in an index from last month for a customer product checkout. The enrichment has happened in "elastic beats" && "logstash" and not entirely in my control. So I cannot simulate the _raw events again.

The only option left is to re-index a "set of events" in order, but just change the "timestamp" of the sequence on the fly. Is there a tool/idea to

  • Get specific data from index
  • reindex these events to another test-index but with "similar timestamp" for today

Eg of what I'm looking for is

You could use reindex with an ingest pipeline (scroll down a little bit with this link, it's under the routing t4ext) to do the processing, or use a painless script.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.