Index is larger after Re-index (6.6.1 to 7)

Elastic Stack Elasticsearch
1

I'm making my way thought reindexing the indices from 6.6.1 to 7 but i'm noticing that the re-indexed index file is larger than the original.

also as part of the re-index the Mapping type has been changed to _doc.

  1. is changing the mapping type _doc makes a difference?
  2. Is there a way of reducing the size of the re-indexed index?

many thanks

2

Is the mapping strictly identical? Can you share it in both cases?
Did you try a _forcemerge on both indices?
Could you run:

GET /_cat/indices/YOURINDEXNAME?v

on both clusters?

3

I ran the command and got back:

health status index                                  uuid                   pri rep docs.count docs.deleted store.size pri.store.size
yellow open   reindexed-v7-filebeat-6.6.1-2019.03.15 rEBcwXB6Rsixj1F3Hs7X_w   5   1    2155531            0   1022.5mb       1022.5mb

this is a result of an in an upgrade process using kibana under the upgrade assistant.

also I have one machine in the cluster, so I would expect the health status to be yellow

4

no i didn't try this

5

And what is the mapping for reindexed-v7-filebeat-6.6.1-2019.03.15 and the mapping for filebeat-6.6.1-2019.03.15?

Also what is the output of:

GET /_cat/indices/filebeat-6.6.1-2019.03.15?v
6

there isn't an one it's now the alias. refers back to the re-indexed copy

7

So what was the concrete index name?

8

reindexed-v7-filebeat-6.6.1-2019.03.15

9

What was the concrete index name for the source?

10

filebeat-6.6.1-2019.03.15

the source index is gone after the reindex

please note I am using the Upgrade Assistant to do the reindex

11

I see.

Can you remember exactly what was its size?

12

off the top of my head it was 750-800mb...

13

Do you still have other indices which you did not migrate yet?