How to reindex a data stream into another data stream?

Elastic Stack Elasticsearch
1

Hi community,

I’m trying to reindex data from one data stream to another.

Basically, I want data from this data stream logs-syslog.myproduct.logs to go into logs-syslog.myproduct_logs-default

The issue is that when the original data stream was created, I used `logs` as the namespace. I now want to move the data to the default namespace instead.

I tried the reindex request:

POST _reindex
{
  "source": {
    "index": ".ds-logs-syslog.myproduct-logs-2025.08.16-000004",
  },
  "dest": {
    "index": "logs-syslog.myproduct_logs-default",
    "pipeline": "_none",
    "op_type": "create"
  },
  "conflicts": "proceed"
}

However, I’m getting the following error for all documents:

    {
      "index": ".ds-logs-syslog.myproduct-logs-2025.08.16-000004",
      "id": "bIPpTZkBpFzTMhyAGyn-",
      "cause": {
        "type": "document_parsing_exception",
        "reason": "[1:1062] failed to parse field [data_stream.namespace] of type [constant_keyword] in document with id 'bIPpTZkBpFzTMhyAGyn-'. Preview of field's value: 'logs'",
        "caused_by": {
          "type": "illegal_argument_exception",
          "reason": "[constant_keyword] field [data_stream.namespace] only accepts values that are equal to the value defined in the mappings [default], but got 
[logs]"
        }
      },
      "status": 400
    },

Has anyone run into this before? What’s the proper way to reindex documents into a new data stream with a different namespace & name of the datastream it-self is different?

2

You need to change data_stream.namespace from logs to default to be able to index in the new data stream.

I think you can do that using a script in the reindex.

Something like this:

POST _reindex
{
  "source": {
    "index": ".ds-logs-syslog.myproduct-logs-2025.08.16-000004",
  },
  "script": {
    "source":"ctx._source.data_stream.namespace = 'default'",
    "lang":"painless"
  },
  "dest": {
    "index": "logs-syslog.myproduct_logs-default",
    "pipeline": "_none",
    "op_type": "create"
  },
  "conflicts": "proceed"
}