I accidentally reindexed a bunch of documents into a wrong index. This original index was previously forcemerged to one big segment per shard. Indexing new documents created new segments leaving original segments as is.
How would you fix such mess?
Technically should be possible to just delete those new segments and be done.But I don't think elastic allows deleting segments, right? So I ask if elastic allows me show what documents live in these new segments, so I delete them by ID.
Yes, changing files by hand is super bad idea.
I was hoping there is way to see what is in these extra segments so I can call delete API on it.
It is time-series data (logs), so I think snapshots wouldn't make sense, right?
Anyway, both indices are from the same index set, so fields are same.
Timestamp is different and that helps identifying most documents to delete, yes.
Remaining problem is documents with timestamps that exists in both indices.
I know I can choose a timestamp and move everything below it to first index and everything above to second and it will be OKish solution, but I am missing better solution, or not?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.