elasticsearch 如何通过过滤器将重新索引应用于新数据值？

这是基本数据（示例）输出值

{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 163,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "0513_final_test_instgram",
        "_type" : "_doc",
        "_id" : "6uShY3kBEkIlakOYovrR",
        "_score" : 1.0,
        "_source" : {
          "host" : "DESKTOP-7MDCA36",
          "path" : "C:/python_file/20210513_114123_instargram.csv",
          "@version" : "1",
          "message" : "hello",
          "@timestamp" : "2021-05-13T02:50:05.962Z"
        },
      {
        "_index" : "0513_final_test_instgram",
        "_type" : "_doc",
        "_id" : "EeShY3kBEkIlakOYovvm",
        "_score" : 1.0,
        "_source" : {
          "host" : "DESKTOP-7MDCA36",
          "path" : "C:/python_file/20210513_114123_instargram.csv",
          "@version" : "1",
          "message" : "python,
          "@timestamp" : "2021-05-13T02:50:05.947Z"
        }

POST _reindex
{
  "source": {
    "index": "0513_final_test_instgram"
  },
  "dest": {
    "index": "new_data_index"
  }
}

首先，在各种字段值中，

只提取了消息值。

（在代码示例下）

我了解了存储新索引的

reindex

但是，即使我看了文件，我也不知道

0513尝试代码

{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 163,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "0513_final_test_instgram",
        "_type" : "_doc",
        "_id" : "6uShY3kBEkIlakOYovrR",
        "_score" : 1.0,
        "_source" : {
          "host" : "DESKTOP-7MDCA36",
          "path" : "C:/python_file/20210513_114123_instargram.csv",
          "@version" : "1",
          "message" : "hello",
          "@timestamp" : "2021-05-13T02:50:05.962Z"
        },
      {
        "_index" : "0513_final_test_instgram",
        "_type" : "_doc",
        "_id" : "EeShY3kBEkIlakOYovvm",
        "_score" : 1.0,
        "_source" : {
          "host" : "DESKTOP-7MDCA36",
          "path" : "C:/python_file/20210513_114123_instargram.csv",
          "@version" : "1",
          "message" : "python,
          "@timestamp" : "2021-05-13T02:50:05.947Z"
        }

POST _reindex
{
  "source": {
    "index": "0513_final_test_instgram"
  },
  "dest": {
    "index": "new_data_index"
  }
}

如何使用reindex在新索引中存储仅提取消息值的数据

更新评论尝试

输出

{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 163,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "new_data_index",
        "_type" : "_doc",
        "_id" : "6uShY3kBEkIlakOYovrR",
        "_score" : 1.0,
        "_source" : {
          "message" : "hello"
        }
      },
      {
        "_index" : "new_data_index",
        "_type" : "_doc",
        "_id" : "EeShY3kBEkIlakOYovvm",
        "_score" : 1.0,
        "_source" : {
          "message" : "python"
        }
      }

如果要重新索引到新索引中，只需执行以下操作：

{
  "source": {
    "index": "0513_final_test_instgram",
    "_source": ["message"]
  },
  "dest": {
    "index": "new_data_index"
  }
}

---

我尝试你的代码。在这些字段中，你不能删除

\u索引、\u类型、\u id和\u分数

有没有办法只保存\u source>消息值？\u索引、\u类型和\u id不是你文档的一部分，它们是元字段，它们将永远存在。您可以在目标索引上应用与在源索引上相同的筛选路径。您的文档将进入

\u source

（这是您唯一可以影响的内容）<代码>\u索引和

\u id

是ES管理的字段，您无法删除它们（这样做没有意义）。但是，当您可以像查询旧索引一样查询新索引时，即

GET new\u data\u index/\u search？\u source=message&filter\u path=hits.hits.\u source