# Unable to \_reindex winlogbeat created index

**URL:** <https://discuss.elastic.co/t/unable-to-reindex-winlogbeat-created-index/118124>\
**Category:** Elasticsearch\
**Created:** [February 1, 2018, 11:39pm UTC](https://discuss.elastic.co/t/unable-to-reindex-winlogbeat-created-index/118124 "2018-02-01T23:39:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lag](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lag/32/37896_2.png) [@lag](https://discuss.elastic.co/u/lag)\
**Post date:** [February 1, 2018, 11:39pm UTC](https://discuss.elastic.co/t/unable-to-reindex-winlogbeat-created-index/118124/1 "2018-02-01T23:39:08Z")

</div>

I have been trying to consolidate winlogbeat indexes to improve performance and overall shard count, it was going very nicely until I run into this:

> POST \_reindex  
> {  
> "conflicts": "proceed",  
> "source": {  
> "index": "winlogbeat-6.1.1-2018.01.08"  
> },  
> "dest": {  
> "index": "winlogbeat-2018.02wk",  
> "op\_type": "create"  
> }  
> }

Result:

> {  
> "took": 6287,  
> "timed\_out": false,  
> "total": 136847,  
> "updated": 0,  
> "created": 19994,  
> "deleted": 0,  
> "batches": 20,  
> "version\_conflicts": 0,  
> "noops": 0,  
> "retries": {  
> "bulk": 0,  
> "search": 0  
> },  
> "throttled\_millis": 0,  
> "requests\_per\_second": -1,  
> "throttled\_until\_millis": 0,  
> "failures": [  
> {  
> "index": "winlogbeat-2018.02wk",  
> "type": "doc",  
> "id": "U1Lt02AB453XNm\_ZtiwS",  
> "cause": {  
> "type": "mapper\_parsing\_exception",  
> "reason": "failed to parse [event\_data.param6]",  
> "caused\_by": {  
> "type": "illegal\_argument\_exception",  
> "reason": "Invalid format: "[1] 0.156, [2] 0.000, [3] 0.000,...""  
> }  
> },  
> "status": 400  
> },  
> {  
> "index": "winlogbeat-2018.02wk",  
> "type": "doc",  
> "id": "KVLt02AB453XNm\_ZqCw-",  
> "cause": {  
> "type": "mapper\_parsing\_exception",  
> "reason": "failed to parse [event\_data.param6]",  
> "caused\_by": {  
> "type": "illegal\_argument\_exception",  
> "reason": "Invalid format: "0D90FD41-FF6D-4366-B4F5-6010010A489A" is malformed at "D90FD41-FF6D-4366-B4F5-6010010A489A""  
> }  
> },  
> "status": 400  
> },  
> {  
> "index": "winlogbeat-2018.02wk",  
> "type": "doc",  
> "id": "VlLt02AB453XNm\_ZtiwS",  
> "cause": {  
> "type": "mapper\_parsing\_exception",  
> "reason": "failed to parse [event\_data.param6]",  
> "caused\_by": {  
> "type": "illegal\_argument\_exception",  
> "reason": "Invalid format: "[1] 0.000, [2] 0.000, [3] 0.000,...""  
> }  
> },  
> "status": 400  
> },  
> {  
> "index": "winlogbeat-2018.02wk",  
> "type": "doc",  
> "id": "kFLv02AB453XNm\_ZHy0O",  
> "cause": {  
> "type": "mapper\_parsing\_exception",  
> "reason": "failed to parse [event\_data.param6]",  
> "caused\_by": {  
> "type": "illegal\_argument\_exception",  
> "reason": "Invalid format: "0D90FD41-FF6D-4366-B4F5-6010010A489A" is malformed at "D90FD41-FF6D-4366-B4F5-6010010A489A""  
> }  
> },  
> "status": 400  
> },  
> {  
> "index": "winlogbeat-2018.02wk",  
> "type": "doc",  
> "id": "tlLv02AB453XNm\_ZPS2G",  
> "cause": {  
> "type": "mapper\_parsing\_exception",  
> "reason": "failed to parse [event\_data.param6]",  
> "caused\_by": {  
> "type": "illegal\_argument\_exception",  
> "reason": "Invalid format: "[1] 0.000, [2] 0.000, [3] 0.000,...""  
> }  
> },  
> "status": 400  
> },  
> {  
> "index": "winlogbeat-2018.02wk",  
> "type": "doc",  
> "id": "91Lv02AB453XNm\_ZZC3p",  
> "cause": {  
> "type": "mapper\_parsing\_exception",  
> "reason": "failed to parse [event\_data.param6]",  
> "caused\_by": {  
> "type": "illegal\_argument\_exception",  
> "reason": "Invalid format: "[1] 0.500, [2] 0.000, [3] 0.016,...""  
> }  
> },  
> "status": 400  
> }  
> ]  
> }

Any suggestions how I can fix this issue?

---

<div class="post-metadata">

**Author:** ![lag](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lag/32/37896_2.png) [@lag](https://discuss.elastic.co/u/lag)\
**Post date:** [February 2, 2018, 6:20pm UTC](https://discuss.elastic.co/t/unable-to-reindex-winlogbeat-created-index/118124/2 "2018-02-02T18:20:54Z")

</div>

Still no idea how to resolve this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 2, 2018, 6:20pm UTC](https://discuss.elastic.co/t/unable-to-reindex-winlogbeat-created-index/118124/3 "2018-03-02T18:20:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.