LS error while reindexing data

Elastic Stack Logstash
1

Hi Experts ,

I am using logstash1.5.4 with ES1.7.1 to reindex old data to a new index . My LS conf file is like

input {
  elasticsearch {
    hosts => "localhost"
    index => "based1"
    query => "*"
    size => 500
    scroll => "5m"
    docinfo => true
  }
}
output {
  elasticsearch {
    action => "index" 
    index => "copy-of-production.%{[@metadata][_index]}"
    document_type => "%{[@metadata][_type]}"
    document_id => "%{[@metadata][_id]}"
  }
}

Now after running above conf i am getting below error

←[31mA plugin had an unrecoverable error. Will restart this plugin.
  Plugin: <LogStash::Inputs::Elasticsearch hosts=>["localhost"], index=>"based1", query=>"*", size=>500, scroll=>"5m", docinf
o=>true, debug=>false, codec=><LogStash::Codecs::JSON charset=>"UTF-8">, port=>9200, scan=>true, docinfo_target=>"@metadata",
 docinfo_fields=>["_index", "_type", "_id"], ssl=>false>
  Error: [400] {"error":"SearchPhaseExecutionException[Failed to execute phase [init_scan], all shards failed; shardFailures
{[WUV4iHvsTmOMV85yeaotEQ][based1][0]: SearchParseException[[based1][0]: from[-1],size[-1]: Parse Failure [Failed to parse sou
rce [_na_]]]; nested: ElasticsearchParseException[Failed to derive xcontent]; }{[WUV4iHvsTmOMV85yeaotEQ][based1][1]: SearchPa
rseException[[based1][1]: from[-1],size[-1]: Parse Failure [Failed to parse source [_na_]]]; nested: ElasticsearchParseExcept
ion[Failed to derive xcontent]; }{[WUV4iHvsTmOMV85yeaotEQ][based1][2]: SearchParseException[[based1][2]: from[-1],size[-1]: P
arse Failure [Failed to parse source [_na_]]]; nested: ElasticsearchParseException[Failed to derive xcontent]; }{[WUV4iHvsTmO
MV85yeaotEQ][based1][3]: SearchParseException[[based1][3]: from[-1],size[-1]: Parse Failure [Failed to parse source [_na_]]];
 nested: ElasticsearchParseException[Failed to derive xcontent]; }{[WUV4iHvsTmOMV85yeaotEQ][based1][4]: SearchParseException[
[based1][4]: from[-1],size[-1]: Parse Failure [Failed to parse source [_na_]]]; nested: ElasticsearchParseException[Failed to
 derive xcontent]; }]","status":400} {:level=>:error}←[0m

Any idea what is it ?

Thanks
VG

2

Vikas, any luck with this? I got the same error

3

I could solve this by removing query => "*" . By default elasticsearch input takes match_all

4

Thanks Krishna,

Actually I re index the data since I was not able to resolve this . Will try with this new approach

Thanks
Vikas