Reprocess documents

Elastic Stack Elasticsearch
1

I have documents that currently exist with a single _message field containing raw json. I'd like to reprocess all these documents and run them through a json parser to update the document and add fields / values.

What's the best approach for this?
External script to query, find a record needing updates, update it, then push it back to es as an update, or some other way?

Thanks
Zach

2

You may want to look into using the reindex API together with an ingest node pipeline. This should work as long as all data is present within each document. If you want to parse and enrich it based on external data, you may need a different approach, e.g. Logstash.

3

That seems like a great idea, thank you for pointing it out.