# assuming @timestamp is the time series field

# replace ES-HOST and INDEX-PARTTERN with your own

curl -XPOST "http://ES-HOST:9200/_reindex?pretty" -H 'Content-Type: application/json' -d'
{  
       "conflicts":"proceed",
       "source":{  
        "index":"INDEX-PARTTERN*"
      },
       "dest":{  
        "index":"somename",       # this name is overwritten in the inline script
        "op_type":"create"
   },
   "script":{  
        "inline":"""
            if (ctx._source[\"@timestamp\"] != null ) {
                def sf = new SimpleDateFormat(\"yyyy-MM-dd'\''T'\''HH:mm:ss.SSS\");
                def dt = sf.parse(ctx._source[\"@timestamp\"]);
                def calendar = sf.getCalendar();
                calendar.setTime(dt);
                ctx._index = \"INDEX-PARTTERN\" + calendar.get(Calendar.YEAR) + \".\" + calendar.get(Calendar.WEEK_OF_YEAR);
                ctx._id = ctx._index + \":\" + ctx._id;
            """
        }
       }
}'

Elasticsearch - Reindex daily indices into weekly

13

Votes

Vote Here

You must earn at least 1 vote on your snippets to be allowed to vote