Merge two indexes to one

[Neelam_Zanvar]

Hi i would like to merge two indexes to one index, with same fields except for one field.
i tried the reindex api but it is not working with regular expressions in the indexname. my index has timestamp attached to it. so i want index1-timestamp1 and index2-timestamp1 to be mergeed to index3-timestamp3. How can i do that?

[mostafaelsayed]

Not Sure if it will help your use case
but have a look at this
Reindex daily indices

[Samuele_Lolli]

Hi @Neelam_Zanvar,
maybe you can create a logstash pipeline that take in input the index you want to merge and in output the final index.

Let me know if that can work

[Neelam_Zanvar]

can i get a sample for the same?

[Samuele_Lolli]

Maybe something like that:

input {
  elasticsearch {
    hosts => "localhost"
    query => '{ "query": { "match": { "statuscode": 200 } }, "sort": [ "_doc" ] }'
  }
  elasticsearch {
    hosts => "localhost"
    query => '{ "query": { "match": { "statuscode": 200 } }, "sort": [ "_doc" ] }'
  }
}
output {
  elasticsearch {
  hosts => "hostname"
  data_stream => "true"
  }
}