How to reindex after updating a field's ignore_above attribute

Elastic Stack Elasticsearch
1

Hi.

I have an index created using dynamic mapping with a field set to the default ignore_above value of 256. I realized that the length is not nearly as high as I would need since the field can have stack traces.

I updated the field using the following syntax ...

PUT /dclogstash-2020.11.04
{
  "mappings": {
    "properties": {
        "Message": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 3000
          }
        }
      }
    }
  }
}

Now that the field is updated, it is my understanding that only new messages will be indexed accordingly, but I need all of the messages currently in the index to respect the update.

My question is how do I re-index my index to take advantage of the updated Keyword length?

Thanks.

2

I see that there is a reindex api , but I was hoping to reindex in place instead of creating a new index.

3

I did a bit more testing and it appears that you can use the Update By Query command without a document in order to update all documents.

POST dclogstash-2020.11.04/_update_by_query?conflicts=proceed

I'm curious if this is the best way to go about updating the documents in the index. It appears that these documents are not versioned and therefore consume a considerable amount more space.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.