In this tutorial I will show you how to reindex daily indices to a monthly index on Elasticsearch using Logstash
Use Case
In this scenario we have filebeat indices which have a low document count and would like to aggregate the daily indices into a bigger index, which will be a monthly index. So reindexing from "filebeat-2019.08.*" to "filebeat-monthly-2019.08".
Overview of our Setup
Here we can see all the indices that we would like to read from"
1234567
$ curl 10.37.117.130:9200/_cat/indices/filebeat-2019.08.*?v
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open filebeat-2019.08.28 qoKiHUjQT5eNVF_wjLi9fA 5 1 17 0 295.4kb 147.7kb
green open filebeat-2019.08.27 8PWngqFdRPKLEnrCCiw6xA 5 1 301 0 900.9kb 424kb
green open filebeat-2019.08.29 PiG2ma8zSbSt6sSg7soYPA 5 1 24 0 400.2kb 196kb
green open filebeat-2019.08.31 XSWZvqQDR0CugD23y6_iaA 5 1 27 0 451.5kb 222.1kb
green open filebeat-2019.08.30 u_Hr9fA5RtOtpabNGUmSpw 5 1 18 0 326.1kb 163kb
As elasticsearch create 5 primary shards by default, I want to override this behavior to creating 3 primary shards. I will be using a template, so whenever a index get created with the index pattern `“-monthly-”, it will apply the settings to create 3 primary shards and 1 replica shards:
Our logstash configuration which we will use, will read from elasticsearch and the index pattern which we want to read from. Then our ouput configuration instructs where to write the data to:
$ curl 10.37.117.130:9200/_cat/indices/*filebeat-*08*?v
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open filebeat-2019.08.28 qoKiHUjQT5eNVF_wjLi9fA 5 1 17 0 295.4kb 147.7kb
green open filebeat-2019.08.29 PiG2ma8zSbSt6sSg7soYPA 5 1 24 0 400.2kb 196kb
green open filebeat-2019.08.30 u_Hr9fA5RtOtpabNGUmSpw 5 1 18 0 326.1kb 163kb
green open filebeat-2019.08.27 8PWngqFdRPKLEnrCCiw6xA 5 1 301 0 900.9kb 424kb
green open filebeat-2019.08.31 XSWZvqQDR0CugD23y6_iaA 5 1 27 0 451.5kb 222.1kb
green open filebeat-monthly-2019.08 VZD8iDjfTfeyP-SWB9l2Pg 3 1 387 0 577.8kb 274.7kb
Once we are happy with what we are seeing, we can delete the source data: