How to view documents by lucene segment?

Elastic Stack Elasticsearch
1

Hello elasticsearch,
I have a tricky question.

I accidentally reindexed a bunch of documents into a wrong index. This original index was previously forcemerged to one big segment per shard. Indexing new documents created new segments leaving original segments as is.

How would you fix such mess?

Technically should be possible to just delete those new segments and be done.But I don't think elastic allows deleting segments, right? So I ask if elastic allows me show what documents live in these new segments, so I delete them by ID.

2

Do not just go and delete the segments by hand... That is a recipe for painful experience, that is not supported.

Perhaps Restore from snapshot?

Is there any other identifiable field in the new reindex/ new documents?

3

Yes, changing files by hand is super bad idea.
I was hoping there is way to see what is in these extra segments so I can call delete API on it.

It is time-series data (logs), so I think snapshots wouldn't make sense, right?
Anyway, both indices are from the same index set, so fields are same.
Timestamp is different and that helps identifying most documents to delete, yes.

Remaining problem is documents with timestamps that exists in both indices.
I know I can choose a timestamp and move everything below it to first index and everything above to second and it will be OKish solution, but I am missing better solution, or not?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.