Why Reindexing data in Elasticsearch? - Purpose & Use Cases

The Big Idea

What if you could fix your entire Elasticsearch data structure in minutes instead of days?

The Scenario

Imagine you have thousands of documents stored in Elasticsearch, but you realize the data structure needs to change--maybe you want to add a new field or fix a mapping error. Doing this manually means fetching each document, changing it, and saving it back one by one.

The Problem

This manual approach is slow and risky. It can take hours or days, and you might accidentally lose data or create inconsistencies. Also, your search service might be down or inconsistent during this time, frustrating users.

The Solution

Reindexing in Elasticsearch lets you copy all your data from one index to another automatically, applying changes on the fly. It's fast, safe, and keeps your search service running smoothly without manual hassle.

Before vs After

✗ Before

GET /old_index/_search
for each hit:
  modify document
  PUT /old_index/_doc/{id} with updated document

✓ After

POST _reindex
{
  "source": {"index": "old_index"},
  "dest": {"index": "new_index"}
}

What It Enables

Reindexing empowers you to update your entire dataset structure quickly and safely without downtime or manual errors.

Real Life Example

A company wants to add a new "category" field to all product documents to improve search filtering. Instead of editing each product manually, they reindex all data with the new field added automatically.

Key Takeaways

Manual data updates in Elasticsearch are slow and error-prone.

Reindexing automates copying and transforming data safely.

This keeps your search service reliable and up-to-date.

Practice

1.

What is the main purpose of _reindex API in Elasticsearch?

easy

A. To delete an index permanently

B. To copy data from one index to another

C. To update the Elasticsearch cluster settings

D. To create a new index with default settings

Solution

1. Step 1: Understand the function of _reindex

   The _reindex API is designed to copy documents from a source index to a destination index.

2. Step 2: Differentiate from other operations

   Deleting an index, updating cluster settings, or creating new indexes are different APIs and not the purpose of _reindex.

3. Final Answer:

   To copy data from one index to another -> Option B

4. Quick Check:

   _reindex copies data [OK]

Hint: Remember: reindex means copying data between indexes [OK]

Common Mistakes:

• Confusing reindex with deleting indexes
• Thinking reindex updates cluster settings
• Assuming reindex creates new indexes without data

2.

Which of the following is the correct minimal syntax to reindex data from old_index to new_index using Elasticsearch's REST API?

{
  "source": {"index": "old_index"},
  "dest": {"index": "new_index"}
}

easy

A. { "source": { "index": "old_index" }, "dest": { "index": "new_index" } }

B. { "source": { "index": "new_index" }, "dest": { "index": "old_index" } }

C. { "source": { "index": "old_index" }, "destination": { "index": "new_index" } }

D. { "src": { "index": "old_index" }, "dest": { "index": "new_index" } }

Solution

1. Step 1: Check the required keys for reindex

   The correct keys are source and dest with nested index names.

2. Step 2: Validate the index names and key spelling

   { "source": { "index": "old_index" }, "dest": { "index": "new_index" } } uses correct keys and index names. { "source": { "index": "new_index" }, "dest": { "index": "old_index" } } swaps source and destination incorrectly. { "source": { "index": "old_index" }, "destination": { "index": "new_index" } } uses wrong key destination. { "src": { "index": "old_index" }, "dest": { "index": "new_index" } } uses wrong key src.

3. Final Answer:

   { "source": { "index": "old_index" }, "dest": { "index": "new_index" } } -> Option A

4. Quick Check:

   Use source and dest keys exactly [OK]

Hint: Use exact keys: source and dest for reindex JSON [OK]

Common Mistakes:

• Swapping source and destination indexes
• Using wrong keys like 'src' or 'destination'
• Misspelling 'dest' or 'source'

3.

Given the following reindex request, what will be the result?

{
  "source": { "index": "products" },
  "dest": { "index": "products_new" },
  "script": {
    "source": "ctx._source.price = ctx._source.price * 1.1"
  }
}

Assuming products has documents with a price field.

medium

A. Only documents with price > 1.1 are copied

B. Documents copied without any price change

C. Reindex fails due to script syntax error

D. All documents copied with price increased by 10%

Solution

1. Step 1: Understand the script in reindex

   The script modifies each document's price by multiplying it by 1.1 during reindexing.

2. Step 2: Effect on documents

   All documents from products are copied to products_new with updated price values increased by 10%.

3. Final Answer:

   All documents copied with price increased by 10% -> Option D

4. Quick Check:

   Script modifies price during reindex [OK]

Hint: Scripts can modify fields during reindexing [OK]

Common Mistakes:

• Assuming script filters documents instead of modifying
• Thinking script causes syntax error
• Believing price remains unchanged

4.

Identify the error in this reindex request:

{
  "source": { "index": "old_index" },
  "dest": { "index": "new_index" },
  "query": {
    "match": { "status": "active" }
  }
}

medium

A. The query should be inside the "source" object

B. "query" is not allowed inside reindex requests

C. The "match" syntax is incorrect

D. The "dest" index name cannot be "new_index"

Solution

1. Step 1: Check placement of query in reindex

   The query must be inside the source object to filter documents.

2. Step 2: Validate other parts

   The match syntax is correct, and dest index name is valid.

3. Final Answer:

   The query should be inside the "source" object -> Option A

4. Quick Check:

   Put query inside source to filter during reindex [OK]

Hint: Put filters inside source, not at top level [OK]

Common Mistakes:

• Placing query outside source object
• Misunderstanding match query syntax
• Thinking destination index name is invalid

5.

You want to reindex data from logs_2023 to logs_archive but only include documents where level is "error" and add a new field archived set to true. Which reindex request achieves this?

hard

A. { "source": { "index": "logs_2023", "query": { "match": { "level": "error" } } }, "dest": { "index": "logs_archive" }, "script": { "source": "ctx._source.archived = false" } }

B. { "source": { "index": "logs_2023" }, "dest": { "index": "logs_archive" }, "query": { "term": { "level": "error" } }, "script": { "source": "ctx._source.archived = true" } }

C. { "source": { "index": "logs_2023", "query": { "term": { "level": "error" } } }, "dest": { "index": "logs_archive" }, "script": { "source": "ctx._source.archived = true" } }

D. { "source": { "index": "logs_2023", "query": { "term": { "level": "error" } } }, "dest": { "index": "logs_archive" }, "script": { "source": "ctx._source.archived = false" } }

Solution

1. Step 1: Filter documents by level "error" inside source

   The query with term filter must be inside the source object to select only error level logs.

2. Step 2: Add new field "archived" with value true via script

   The script sets ctx._source.archived = true to add the new field during reindex.

3. Step 3: Validate requests

   The request that places query inside source with term filter for level: "error" and script setting ctx._source.archived = true is correct. Placing query at top level is invalid. Using match instead of term or setting archived to false is incorrect.

4. Final Answer:

   { "source": { "index": "logs_2023", "query": { "term": { "level": "error" } } }, "dest": { "index": "logs_archive" }, "script": { "source": "ctx._source.archived = true" } } -> Option C

5. Quick Check:

   Filter in source + script sets field true [OK]

Hint: Filter inside source; script adds fields during reindex [OK]

Common Mistakes:

• Placing query outside source object
• Setting wrong value for new field
• Using match instead of term for exact filter