# Logs from ES 2.2.0 to ES 5.0.2 with Logstash with date of indexing?

**URL:** <https://discuss.elastic.co/t/logs-from-es-2-2-0-to-es-5-0-2-with-logstash-with-date-of-indexing/69407>\
**Category:** Logstash\
**Created:** [December 19, 2016, 8:56am UTC](https://discuss.elastic.co/t/logs-from-es-2-2-0-to-es-5-0-2-with-logstash-with-date-of-indexing/69407 "2016-12-19T08:56:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lifesaver13](https://avatars.discourse-cdn.com/v4/letter/l/6f9a4e/32.png) [@lifesaver13](https://discuss.elastic.co/u/lifesaver13)\
**Post date:** [December 19, 2016, 8:56am UTC](https://discuss.elastic.co/t/logs-from-es-2-2-0-to-es-5-0-2-with-logstash-with-date-of-indexing/69407/1 "2016-12-19T08:56:09Z")

</div>

Hello everyone,

I'm moving old logs of my ElasticSearch 2.2.0 to an higher version of ElasticSearch 5.0.2 using Logstash. I write the following configuration :

input  
{  
elasticsearch  
{  
hosts =\> ["localhost:9200"]  
index =\> "old-logs\*"  
}  
}

output  
{  
elasticsearch  
{  
hosts =\> ["localhost:9201"]  
index =\> "old-logs..." # looking for index with the date of indexing #  
}  
stdout { codec =\> rubydebug }  
}

The moving is working but I would like to know how I can move the logs by date of indexing?

for exemple I've got the index old-log-01-12-2015, old-log-02-12-2016, etc... in ES 2.2.0 I wouls like to have the same index in ES 5.0.2

Thank you

J.S

---

<div class="post-metadata">

**Author:** ![jakommo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakommo/32/6716_2.png) [@jakommo](https://discuss.elastic.co/u/jakommo)\
**Post date:** [December 20, 2016, 4:43pm UTC](https://discuss.elastic.co/t/logs-from-es-2-2-0-to-es-5-0-2-with-logstash-with-date-of-indexing/69407/2 "2016-12-20T16:43:43Z")

</div>

I think what you are looking for is the [docinfo setting](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-elasticsearch.html#plugins-inputs-elasticsearch-docinfo) of the Elasticsearch input. This will include the metadata of the indices you are reading from, which you can then use in the output section to define the index the data is being written to.  
The doc page linked above also has an example config for this.

About reindexing from one cluster into another, you don't need Logstash for this anymore, as the \_reindex API got support for [remote reindexing](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html#reindex-from-remote) in 5.0. Also see [this page](https://www.elastic.co/guide/en/elasticsearch/reference/current/reindex-upgrade.html#reindex-upgrade-remote).

---

<div class="post-metadata">

**Author:** ![lifesaver13](https://avatars.discourse-cdn.com/v4/letter/l/6f9a4e/32.png) [@lifesaver13](https://discuss.elastic.co/u/lifesaver13)\
**Post date:** [December 21, 2016, 8:23am UTC](https://discuss.elastic.co/t/logs-from-es-2-2-0-to-es-5-0-2-with-logstash-with-date-of-indexing/69407/3 "2016-12-21T08:23:12Z")

</div>

Hello,

Thank you for your answer! It's working!

J.S

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 18, 2017, 8:23am UTC](https://discuss.elastic.co/t/logs-from-es-2-2-0-to-es-5-0-2-with-logstash-with-date-of-indexing/69407/4 "2017-01-18T08:23:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.