Sometimes you need to rename an Elasticsearch index—maybe to reuse the name for an alias. Officially, this isn’t supported. But with some manual edits and caution, it can be done.

⚠️ Warning: This is dangerous and unsupported. Back up your data first.

If these don’t work for your case, read on.

The Hacky Method

  1. Stop the Elasticsearch node.

  2. Find the metadata files:

    grep -rF --include '*.st' 'my-old-index' data/
    • You’ll usually find matches in state-*.st files in index folders.
    • Sometimes also in global-*.st files.

  3. Edit each match using a hex editor:

    • Replace my-old-index with my-new-index.
    • Keep lengths equal to preserve file structure.

  4. Recalculate the CRC32 checksum:

    • Many editors like HxD support this.
    • CRC32 covers the entire file except the last 8 bytes.
    • Only the last 4 bytes (of those 8) are used.

  5. Double-check:

    • Re-run the grep to ensure all instances were changed.

  6. Restart Elasticsearch.

Notes & Sources

Tested On

Elasticsearch 6.8.12 (single-node, Docker). Renamed to a name of the same length. A new alias was then created for the old name, successfully routing writes to a new index.