Notes: ELK stack

DISCLAIMER: this is not meant to be coherent post. Sorry. Just notes for future reference. There will probably be some future updates here.

ElasticSearch / OpenSearch index reindexing

Sometimes the process of reindexing fails and you're left with partially copied data in the new index. It is sometimes more useful to drop it and start again, but when the index is particularly big the sanest option might be to just copy the missing data from the source to target.

POST _reindex?slices=5&wait_for_completion=false
{
  "conflicts": "proceed",
  "source": {
    "index": "source-2026.10"
  },
  "dest": {
    "index": "target-2026.10",
    "op_type": "create" 
  }
}

Docs link