Reindexing Elasticsearch creates a mapping which cannot be searched

Elastic Stack Elasticsearch
1

Bit of an odd one or I'm missing something.

We reindexed an AWS Elasticsearch index from old_index to new_index but for some reason searches on the new index return no results.

The steps we took are:

Reindex

curl -H 'Content-Type: application/json' -XPOST 'hostname/_reindex' -d '
{
  "source": {
    "index": "old_index"
  },
  "dest": {
    "index": "new_index"
  }
}'

The mapping of the old index is:

{
    "old_index": {
        "mappings": {
            "share": {
                "dynamic": "false",
                "properties": {
                    "creationDate": {
                        "type": "long"
                    },
                    "eventId": {
                        "type": "keyword"
                    },
                    "title": {
                        "type": "text"
                    },
                    "userId": {
                        "type": "keyword"
                    }
                }
            }
        }
    }
}

The mapping of the new index is:

{
    "new_index": {
        "mappings": {
            "share": {
                "properties": {
                    "age": {
                        "type": "long"
                    },
                    "creationDate": {
                        "type": "long"
                    },
                    "eventId": {
                        "type": "text",
                        "fields": {
                            "keyword": {
                                "type": "keyword",
                                "ignore_above": 256
                            }
                        }
                    },
                    "title": {
                        "type": "text",
                        "fields": {
                            "keyword": {
                                "type": "keyword",
                                "ignore_above": 256
                            }
                        }
                    },
                    "userId": {
                        "type": "text",
                        "fields": {
                            "keyword": {
                                "type": "keyword",
                                "ignore_above": 256
                            }
                        }
                    }
                }
            }
        }
    }
}

If we do a match_all query on either index both report an identical number of documents. However if we do a filter query like so:

{
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "eventId": {
              "value": "abc123"
            }
          }
        }
      ]
    }
  }
}

Only the old_index returns a match, the new index does not despite containing a document with a corresponding eventId.

Questions are:

  1. Where is the age property in the new_index coming from?
  2. Why is reindexing changing the mapping?
  3. Is there something in the mapping of new_index which is preventing our filter query above from working?
2

Reindex just reads documents from a source and send the Json to a destination.

If you don't create a mapping, elasticsearch generates a default mapping for you. That's what happened.

3

Thanks based upon the above auto generated mapping for new_index shouldn't my above filter on term eventId returned a matching document?

Because it did for old_index but not the new one.

4

I don't think so.
But if you search on eventId.keyword field, it should match.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.