How to use elasticsearch input plugin in logstash to get more than 10000 results from ES

[Moka]

Hello,

I want to copy the data in a distant Es (which I have a limited access ) to another ES where I have full rights.
So,the input Es index contains 50000 documents , and I manage to get only 10000 hits using the following configuration:

input {

elasticsearch {
hosts => ["xxxx:9200"]
index => "forxx"
user => "kibxx"
password =>"xxx!"
query => '{ "query": {"match_all": {}} }'
tags => "table_elastic_to_elastic"
ssl_certificate_verification => false
ssl => true
size => 10000

}
output {

stdout {}
if "table_elastic_to_elastic" in [tags] {
elasticsearch {
    index => "newindex"
    document_id => "%{ID}"
    hosts => ["localhost:9200"]
    }
} 

}**

[npontes]

Is it because you're defining the size to 10000?

[Moka]

If don't specify size=10000 , logstash will use the default value which is equal to 1000

[Vishal_Sharma1 (Vishal Sharma)]

increase the size to 50000

[Moka]

the maximum size is 10000

[Vishal_Sharma1 (Vishal Sharma)]

use the scroll API, search the forums here and you will get answers. Its always a good practice to search the forum before posting or google it
If still need help please ask here

[Moka]

if I don't specify scroll , then logstash will use the default value which is equal to "1m".
I've searched google and forums but I didn't find any answers

[npontes]

Have you tried on Postman perform a GET to see if you're receiving 50k or just 10k?

[Magnus_Kessler]

Any reason why you can't use Reindex from Remote instead of Logstash?

[Moka]

I chose Logstash to run the job everyday at a certain time using Logstash "schedule"

[Magnus_Kessler]

You could use cron or similar to schedule a script that calls the reindex API once a day. The reindex API supports queries, which would allow you to only transfer those entries that were done since the last run (if your data contains timestamps).

When transferring large result sets, you should also look into using the scroll API.