Rename index in Elasticsearch

Elastic Stack Elasticsearch
1

Hello.

  1. Why it is not possible to do in Kibana? You can delete index, but cannot rename. Will you plan to add this feature?
  2. How to rename index in Elasticsearch easilly?
1 Like
2

Hi @smerzlyakov,

I would like to tell you that there is no such process to rename the index in elasticsearch. However if you want to rename you need to reindex the same with new name and for reindex you can use reindex API in elasticsearch.

Please find the reference link for reindex API.
https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html

Regards,
Harsh Bajaj

3

How to rename index in Elasticsearch easilly?

Use an index alias. It's not a "rename" as per say but can probably help without needing to reindex.

4

Thank you, Harsh.
And when i need to rename multiple indexes for this mask, for example:
filebeat-%{+YYYY.MM.dd}
And want to do it for two mounth, how must i construct the query?
POST _reindex
{
"source": {
"index": "filebeat-2019-mm.dd"
},
"dest": {
"index": "filebeat_new-2019-mm.dd"
}
}

5

Thank you David, but i need to rename it. I want to use previous name for different purpose and it is hard to support future renaming with aliases, i think.
My case with Elastic is SIEM-like.
First you get all logs in raw format to ELK. And name it once.
Than you try to normalise them with ECS.
And you do it multiple times. You do mistakes in naming, go to some standart for your organisation.
I think ELK really need the feature with renaming.

6

I'd read this: https://www.elastic.co/fr/blog/migrating-to-elastic-common-schema-in-beats-environments

7

Hi @smerzlyakov,

I didn't understand your requirement. Could you clear bit more about your use case?

Regards,
Harsh Bajaj

8

Hi @harshbajaj16,

Just what command it must be to (rename) reindex multiple indexes at once?

9

Hi @smerzlyakov,

I don't think so that you can do reindex multiple index in one go.

Regards,
Harsh Bajaj

1 Like
10

Hi @Harsh,
It is defenetly possible to rename multiple indexes in one go. For example multiple to one (doc):

POST _reindex
{
  "source": {
    "index": ["twitter", "blog"]
  },
  "dest": {
    "index": "all_together"
  }
}

But i cant find example for reindexing multiple to multiple. Like [index1,index2] to [new_index1, new_index2]

11

Hi @smerzlyakov,

I was talking about this scenario only.

Yes, it is possible to insert new documents while reindexing your index as you shown above. However, Like [index1,index2] to [new_index1, new_index2]not possible.

Regards,
Harsh Bajaj

1 Like
12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.