Create an index from search results using _reindex API

Question

I'am tring to store the results of my search request in new index. This is my code:

POST /_reindex
{ 
  "source": {
    "index": "my_index_name",
    "query": {
    "bool": {
      "must": [
        {
          "match": {
            "host.hostname": "value_1"
          }
        },
        {
          "match": {
            "message": "value_a"
          }
        }
      ]
    }
  },
   "size":3
  },
  "dest": {
    "index": "new_test"
  }
}

This request is limited to a size of 3. However the size limit is not taken into account. Hence the Post request result is 502 error with this message:

{"ok":false,"message":"backend closed connection"}

My question is how can i store the result of the request above in a new index in ELasticsearch? Thank you in advance for your help.

Answer 1

You need to specify the top-level max_docs parameter instead of source.size:

POST /_reindex
{
  "max_docs": 3,
  "source": {
    "index": "my_index_name",
    "query": {
      "bool": {
        "must": [
          {
            "match": {
              "host.hostname": "value_1"
            }
          },
          {
            "match": {
              "message": "value_a"
            }
          }
        ]
      }
    }
  },
  "dest": {
    "index": "new_test"
  }
}

Answer 2

You need to set max_docs param to your request.

POST _reindex
{
  "max_docs": 1,
  "source": {
    "index": "my-index-000001"
  },
  "dest": {
    "index": "my-new-index-000001"
  }
}

size param is for number of documents to index per batch.

By default _reindex uses scroll batches of 1000. You can change the batch size with the size field in the source element