Hey there,
if _ttl expiration value is configured within the documents of an index, is there a way to export/reindex those documents with the _ttl value of that moment?
For instance, using Logstash elasticsearch input we can inherit _id but no way to get the _ttl
Which version are you using? TTL has as far as I know been deprecated quite a long time.
At the end of my process I have to migrate data from a 2.4 version to 7.x but before that I have to change my infrastructure so for the moment I have to migrate from a 2.4 to another 2.4 (I am trying to use logstash)
I have not used version 2.x in years so do not recall how TTL worked apart from that it was quite inefficient. If the TTL value is not in the document I suspect you may not be able to export it. Using snapshot and restore to move the data might be better. You could perhaps also set up a newer cluster and reindex from remote, but it is hard to know without knowing the use case and constraints.
About snapshot and restore, are you talking of simple snapshot of VM?
No, using the Elasticsearch snapshot/restore API.
Hmmm.... Is it possible to use snapshot/restore with source Elasticsearch 2.4 and destination Elasticsearch 2.4?
Yes.
after further investigation, snapshot/restore option is not possible since src nodes and dst nodes could not share the same disk where snapshot will be stored 
I was thinking to script option in the Logstash elasticsearch output. Maybe is it possible to get the _ttl value and import it with script?
You can take a snapshot to shared storage in one place and then move that data over to the new cluster and mount it there.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.