How do I apply reindex to new data values through filters?

Viewed 182

This is basic_data(example) Output value

{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 163,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "0513_final_test_instgram",
        "_type" : "_doc",
        "_id" : "6uShY3kBEkIlakOYovrR",
        "_score" : 1.0,
        "_source" : {
          "host" : "DESKTOP-7MDCA36",
          "path" : "C:/python_file/20210513_114123_instargram.csv",
          "@version" : "1",
          "message" : "hello",
          "@timestamp" : "2021-05-13T02:50:05.962Z"
        },
      {
        "_index" : "0513_final_test_instgram",
        "_type" : "_doc",
        "_id" : "EeShY3kBEkIlakOYovvm",
        "_score" : 1.0,
        "_source" : {
          "host" : "DESKTOP-7MDCA36",
          "path" : "C:/python_file/20210513_114123_instargram.csv",
          "@version" : "1",
          "message" : "python,
          "@timestamp" : "2021-05-13T02:50:05.947Z"
        }

First of all, out of various field values, only message values have been extracted.(under code example)

GET 0513_final_test_instgram/_search?_source=message&filter_path=hits.hits._source
{
  "hits" : {
    "hits" : [
      {
        "_source" : {
          "message" : "hello"
        }
      },
      {
        "_source" : {
          "message" : "python"
        }

I got to know reindex that stores new indexes.

https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html

However, I don't know even if I look at the document.

0513 attempt code

POST _reindex
{
  "source": {
    "index": "0513_final_test_instgram"
  },
  "dest": {
    "index": "new_data_index"
  }
}

How do you use reindex to store data that only extracted message values in a new index?

update comment attempt

output

{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 163,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "new_data_index",
        "_type" : "_doc",
        "_id" : "6uShY3kBEkIlakOYovrR",
        "_score" : 1.0,
        "_source" : {
          "message" : "hello"
        }
      },
      {
        "_index" : "new_data_index",
        "_type" : "_doc",
        "_id" : "EeShY3kBEkIlakOYovvm",
        "_score" : 1.0,
        "_source" : {
          "message" : "python"
        }
      }
1 Answers

You simply need to specify which fields you want to reindex into the new index:

{
  "source": {
    "index": "0513_final_test_instgram",
    "_source": ["message"]
  },
  "dest": {
    "index": "new_data_index"
  }
}
Related