# \_ingest on one cluster to index in another

**URL:** <https://discuss.elastic.co/t/ingest-on-one-cluster-to-index-in-another/157883>\
**Category:** Elasticsearch\
**Created:** [November 22, 2018, 1:11pm UTC](https://discuss.elastic.co/t/ingest-on-one-cluster-to-index-in-another/157883 "2018-11-22T13:11:15Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![DidierB](https://avatars.discourse-cdn.com/v4/letter/d/ed8c4c/32.png) [@DidierB](https://discuss.elastic.co/u/DidierB)\
**Post date:** [November 22, 2018, 1:11pm UTC](https://discuss.elastic.co/t/ingest-on-one-cluster-to-index-in-another/157883/1 "2018-11-22T13:11:15Z")

</div>

For some reason I will not mention here, I need to do document **/\_ingest** ion in an Elasticsearch cluster (only the data transformation) and index the transformed document in another cluster. Is it possible to tell an ingest node to index the document in another cluster that the one that it's part of?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 22, 2018, 1:16pm UTC](https://discuss.elastic.co/t/ingest-on-one-cluster-to-index-in-another/157883/2 "2018-11-22T13:16:43Z")

</div>

No, as far as I know it is not.

---

<div class="post-metadata">

**Author:** ![DidierB](https://avatars.discourse-cdn.com/v4/letter/d/ed8c4c/32.png) [@DidierB](https://discuss.elastic.co/u/DidierB)\
**Post date:** [November 22, 2018, 1:27pm UTC](https://discuss.elastic.co/t/ingest-on-one-cluster-to-index-in-another/157883/3 "2018-11-22T13:27:17Z")

</div>

Thanks for your answer. Workaround possible ? Like indexing the event on the ingest node then replicate (realtime) the document on the distant cluster (and the destroy the one on the ingest node)? I thinking of some "reindex" usage.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 22, 2018, 2:09pm UTC](https://discuss.elastic.co/t/ingest-on-one-cluster-to-index-in-another/157883/4 "2018-11-22T14:09:20Z")

</div>

Why not use an ingest node on the other cluster or perhaps Logstash?

---

<div class="post-metadata">

**Author:** ![DidierB](https://avatars.discourse-cdn.com/v4/letter/d/ed8c4c/32.png) [@DidierB](https://discuss.elastic.co/u/DidierB)\
**Post date:** [November 22, 2018, 2:11pm UTC](https://discuss.elastic.co/t/ingest-on-one-cluster-to-index-in-another/157883/5 "2018-11-22T14:11:30Z")

</div>

we are forbidden to use the /\_ingest of the other cluster. However we already have code for /\_ingest pipelines (written in painless if I'm not mistaken) on our dev environment. Is logstash directly compatible with the developed pipelines and can be used as a drop in replacement for the ingest functions of ES?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 22, 2018, 2:21pm UTC](https://discuss.elastic.co/t/ingest-on-one-cluster-to-index-in-another/157883/6 "2018-11-22T14:21:58Z")

</div>

I completely forgot that version 6.5 actually introduced [Cross Cluster Replication](https://www.elastic.co/blog/elasticsearch-6-5-0-released), which does exactly what you describe.

Logstash can do what ingest node can, but you can not directly use the same config. There is however a [conversion utility](https://www.elastic.co/guide/en/logstash/6.5/ingest-converter.html) available that can handle a lot of the available processors, so might be an option.

---

<div class="post-metadata">

**Author:** ![DidierB](https://avatars.discourse-cdn.com/v4/letter/d/ed8c4c/32.png) [@DidierB](https://discuss.elastic.co/u/DidierB)\
**Post date:** [November 22, 2018, 2:23pm UTC](https://discuss.elastic.co/t/ingest-on-one-cluster-to-index-in-another/157883/7 "2018-11-22T14:23:57Z")

</div>

Our target cluster is a 5.5.0, however the ingest one is not installed and could be a 6.5, would this working?

However what you said about logstash maybe a good workaround!

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 22, 2018, 2:25pm UTC](https://discuss.elastic.co/t/ingest-on-one-cluster-to-index-in-another/157883/8 "2018-11-22T14:25:27Z")

</div>

Cross cluster replication require all clusters to be version 6.5 or higher.

---

<div class="post-metadata">

**Author:** ![DidierB](https://avatars.discourse-cdn.com/v4/letter/d/ed8c4c/32.png) [@DidierB](https://discuss.elastic.co/u/DidierB)\
**Post date:** [November 22, 2018, 4:25pm UTC](https://discuss.elastic.co/t/ingest-on-one-cluster-to-index-in-another/157883/9 "2018-11-22T16:25:38Z")

</div>

Thanks a lot for those information.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2018, 4:25pm UTC](https://discuss.elastic.co/t/ingest-on-one-cluster-to-index-in-another/157883/10 "2018-12-20T16:25:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
