# Reindex data on old ES version using Logstash

**URL:** <https://discuss.elastic.co/t/reindex-data-on-old-es-version-using-logstash/272496>\
**Category:** Logstash\
**Created:** [May 9, 2021, 10:43am UTC](https://discuss.elastic.co/t/reindex-data-on-old-es-version-using-logstash/272496 "2021-05-09T10:43:42Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Post date:** [May 9, 2021, 10:43am UTC](https://discuss.elastic.co/t/reindex-data-on-old-es-version-using-logstash/272496/1 "2021-05-09T10:43:42Z")

</div>

Hey there,  
I am trying to reindex data from an old ES version to another old ES version using Logstash with elasticsearch input.  
Anyway I have some doubts. If I schedule the action, during the second execution it will update documents in the target index? Does it will start from the beginning every time?

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 9, 2021, 2:14pm UTC](https://discuss.elastic.co/t/reindex-data-on-old-es-version-using-logstash/272496/2 "2021-05-09T14:14:39Z")

</div>

If you use a schedule it will re-run the same query. If the query does not restrict the data it fetches then it will fetch the same data again and the same documents will be indexed. There is no functionality like a sincedb for the elasticsearch input.

---

<div class="post-metadata">

**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Post date:** [May 9, 2021, 4:41pm UTC](https://discuss.elastic.co/t/reindex-data-on-old-es-version-using-logstash/272496/3 "2021-05-09T16:41:07Z")

</div>

Ok, probably I could use a filter using timestamp field? Or... Is there another way to get my purpose?

---

<div class="post-metadata">

**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Post date:** [May 12, 2021, 10:42am UTC](https://discuss.elastic.co/t/reindex-data-on-old-es-version-using-logstash/272496/4 "2021-05-12T10:42:24Z")

</div>

just another doubt: if I don't specify any `query`, does the first run will execute a query `match_all`?  
if in the meantime the `source` index will be updated with other new docs, does Logstash `input` will get them or not? I mean, the first run will work as a "snapshot" (not literally of course)?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 12, 2021, 4:00pm UTC](https://discuss.elastic.co/t/reindex-data-on-old-es-version-using-logstash/272496/5 "2021-05-12T16:00:09Z")

</div>

The query will fetch whatever data matches the query at the time it executes. It does not fetch any later updates that match it after it executes.

---

<div class="post-metadata">

**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Post date:** [May 13, 2021, 9:48am UTC](https://discuss.elastic.co/t/reindex-data-on-old-es-version-using-logstash/272496/6 "2021-05-13T09:48:01Z")

</div>

using this approach, I saw that I cannot export `_ttl` value from source documents to destination indices.  
is it true?  
into the source index's mapping, I set a default `_ttl` value so I would like to export it, otherwise my destinations documents will have the `_ttl` value reset.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 10, 2021, 9:48am UTC](https://discuss.elastic.co/t/reindex-data-on-old-es-version-using-logstash/272496/7 "2021-06-10T09:48:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
