# Index from another index

**URL:** https://discuss.elastic.co/t/index-from-another-index/14174
**Category:** Elasticsearch
**Created:** [October 30, 2013, 2:00pm UTC](https://discuss.elastic.co/t/index-from-another-index/14174 "2013-10-30T14:00:44Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Uber777](https://avatars.discourse-cdn.com/v4/letter/u/d2c977/32.png) [@Uber777](https://discuss.elastic.co/u/Uber777)
#### Post date: [October 30, 2013, 2:00pm UTC](https://discuss.elastic.co/t/index-from-another-index/14174/1 "2013-10-30T14:00:44Z")

</div>

So I have a logstash index.

How do I extract (regex) key values like Error type, date and time for  
their own elastic search index from an existing index?

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [October 31, 2013, 10:29am UTC](https://discuss.elastic.co/t/index-from-another-index/14174/2 "2013-10-31T10:29:16Z")

</div>

Hey,

your requirement basically means, that you have to retrieve every document  
from your index, modify it (in your case remove some fields except three)  
and then reindex your document. I am not sure, if there is some automatic  
tool for this, but it only requires two manual steps, so it is quite simple  
to do it yourself

You can use the scroll query for this, see

> **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)**
>
> Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today.

> **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)**
>
> Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today.

While you are getting back the results, you could use a  
python/ruby/whateveryoulike script to do the actuall modifications and  
execute the index operation in another index (preferrably batched).

Hope this helps

--Alex

On Wed, Oct 30, 2013 at 3:00 PM, Uber777 [nkatsikanis@gmail.com](mailto:nkatsikanis@gmail.com) wrote:

> So I have a logstash index.
> 
> How do I extract (regex) key values like Error type, date and time for  
> their own Elasticsearch index from an existing index?
> 
> --  
> You received this message because you are subscribed to the Google Groups  
> "elasticsearch" group.  
> To unsubscribe from this group and stop receiving emails from it, send an  
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
> For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 2:09am UTC](https://discuss.elastic.co/t/index-from-another-index/14174/3 "2017-07-06T02:09:39Z")

</div>


