anchor.diff:  
   <1> `_reindex` defaults to sorting by `_doc` so `random_score` will not have any
   effect unless you override the sort to `_score`.
  +
  +[[reindex-scripts]]
  +===== Modify documents during reindexing
  +
  +Like `_update_by_query`, `_reindex` supports a script that modifies the
  +document. Unlike `_update_by_query`, the script is allowed to modify the
  +document's metadata. This example bumps the version of the source document:
  +
  +[source,console]
  +--------------------------------------------------
  +POST _reindex
  +{
  +  "source": {
  +    "index": "twitter"
  +  },
  +  "dest": {
  +    "index": "new_twitter",
  +    "version_type": "external"
  +  },
  +  "script": {
  +    "source": "if (ctx._source.foo == 'bar') {ctx._version++; ctx._source.remove('foo')}",
  +    "lang": "painless"
  +  }
  +}
  +--------------------------------------------------
  +// TEST[setup:twitter]
  +
  +Just as in `_update_by_query`, you can set `ctx.op` to change the
  +operation that is executed on the destination index:
  +
  +`noop`::
  +
  +Set `ctx.op = "noop"` if your script decides that the document doesn't have
  +to be indexed in the destination index. This no operation will be reported
  +in the `noop` counter in the <<docs-reindex-api-response-body, response body>>.
  +
  +`delete`::
  +
  +Set `ctx.op = "delete"` if your script decides that the document must be
  + deleted from the destination index. The deletion will be reported in the
  + `deleted` counter in the <<docs-reindex-api-response-body, response body>>.
  +
  +Setting `ctx.op` to anything else will return an error, as will setting any
  +other field in `ctx`.
  +
  +Think of the possibilities! Just be careful; you are able to
  +change:
  +
  + * `_id`
  + * `_index`
  + * `_version`
  + * `_routing`
  +
  +Setting `_version` to `null` or clearing it from the `ctx` map is just like not
  +sending the version in an indexing request; it will cause the document to be
  +overwritten in the target index regardless of the version on the target or the
  +version type you use in the `_reindex` request.
  +
  +[[reindex-from-remote]]
  +==== Reindex from remote
  +
  +Reindex supports reindexing from a remote Elasticsearch cluster:
  +
  +[source,console]
  +--------------------------------------------------
  +POST _reindex
  +{
  +  "source": {
  +    "remote": {
  +      "host": "http://otherhost:9200",
  +      "username": "user",
  +      "password": "pass"
  +    },
  +    "index": "source",
  +    "query": {
  +      "match": {
  +        "test": "data"
  +      }
  +    }
  +  },
  +  "dest": {
  +    "index": "dest"
  +  }
  +}
  +--------------------------------------------------
  +// TEST[setup:host]
  +// TEST[s/^/PUT source\n/]
  +// TEST[s/otherhost:9200",/\${host}"/]
  +// TEST[s/"username": "user",//]
  +// TEST[s/"password": "pass"//]
  +
  +The `host` parameter must contain a scheme, host, port (e.g.
  +`https://otherhost:9200`), and optional path (e.g. `https://otherhost:9200/proxy`).
  +The `username` and `password` parameters are optional, and when they are present `_reindex`
  +will connect to the remote Elasticsearch node using basic auth. Be sure to use `https` when
  +using basic auth or the password will be sent in plain text.
  +There are a range of <<reindex-ssl,settings>> available to configure the behaviour of the
  + `https` connection.
  +
  +Remote hosts have to be explicitly whitelisted in elasticsearch.yml using the
  +`reindex.remote.whitelist` property. It can be set to a comma delimited list
  +of allowed remote `host` and `port` combinations (e.g.
  +`otherhost:9200, another:9200, 127.0.10.*:9200, localhost:*`). Scheme is
  +ignored by the whitelist -- only host and port are used, for example:
  +
  +
  +[source,yaml]
  +--------------------------------------------------
  +reindex.remote.whitelist: "otherhost:9200, another:9200, 127.0.10.*:9200, localhost:*"
  +--------------------------------------------------
  +
  +The whitelist must be configured on any nodes that will coordinate the reindex.
  +
  +This feature should work with remote clusters of any version of Elasticsearch
  +you are likely to find. This should allow you to upgrade from any version of
  +Elasticsearch to the current version by reindexing from a cluster of the old
  +version.
  +
  +To enable queries sent to older versions of Elasticsearch the `query` parameter
  +is sent directly to the remote host without validation or modification.
  +
  +NOTE: Reindexing from remote clusters does not support
  +<<docs-reindex-manual-slice, manual>> or
  +<<docs-reindex-automatic-slice, automatic slicing>>.
  +
  +Reindexing from a remote server uses an on-heap buffer that defaults to a
  +maximum size of 100mb. If the remote index includes very large documents you'll
  +need to use a smaller batch size. The example below sets the batch size to `10`
  +which is very, very small.
  +
  +[source,console]
  +--------------------------------------------------
  +POST _reindex
  +{
  +  "source": {
  +    "remote": {
  +      "host": "http://otherhost:9200"
  +    },
  +    "index": "source",
  +    "size": 10,
  +    "query": {
  +      "match": {
  +        "test": "data"
  +      }
  +    }
  +  },
  +  "dest": {
  +    "index": "dest"
  +  }
  +}
  +--------------------------------------------------
  +// TEST[setup:host]
  +// TEST[s/^/PUT source\n/]
  +// TEST[s/otherhost:9200/\${host}/]
  +
  +It is also possible to set the socket read timeout on the remote connection
  +with the `socket_timeout` field and the connection timeout with the
  +`connect_timeout` field. Both default to 30 seconds. This example
  +sets the socket read timeout to one minute and the connection timeout to 10
  +seconds:
  +
  +[source,console]
  +--------------------------------------------------
  +POST _reindex
  +{
  +  "source": {
  +    "remote": {
  +      "host": "http://otherhost:9200",
  +      "socket_timeout": "1m",
  +      "connect_timeout": "10s"
  +    },
  +    "index": "source",
  +    "query": {
  +      "match": {
  +        "test": "data"
  +      }
  +    }
  +  },
  +  "dest": {
  +    "index": "dest"
  +  }
  +}
  +--------------------------------------------------
  +// TEST[setup:host]
  +// TEST[s/^/PUT source\n/]
  +// TEST[s/otherhost:9200/\${host}/]
  +
  +[[reindex-ssl]]
  +===== Configuring SSL parameters
  +
  +Reindex from remote supports configurable SSL settings. These must be
  +specified in the `elasticsearch.yml` file, with the exception of the
  +secure settings, which you add in the Elasticsearch keystore.
  +It is not possible to configure SSL in the body of the `_reindex` request.
  +
  +The following settings are supported:
  +
  +`reindex.ssl.certificate_authorities`::
  +List of paths to PEM encoded certificate files that should be trusted. 
  +You cannot specify both `reindex.ssl.certificate_authorities` and
  +`reindex.ssl.truststore.path`.
  +
  +`reindex.ssl.truststore.path`::
  +The path to the Java Keystore file that contains the certificates to trust.
  +This keystore can be in "JKS" or "PKCS#12" format.
  +You cannot specify both `reindex.ssl.certificate_authorities` and
  +`reindex.ssl.truststore.path`.
  +
  +`reindex.ssl.truststore.password`::
  +The password to the truststore (`reindex.ssl.truststore.path`).
  +This setting cannot be used with `reindex.ssl.truststore.secure_password`.
  +
  +`reindex.ssl.truststore.secure_password` (<<secure-settings,Secure>>)::
  +The password to the truststore (`reindex.ssl.truststore.path`).
  +This setting cannot be used with `reindex.ssl.truststore.password`.
  +
  +`reindex.ssl.truststore.type`::
  +The type of the truststore (`reindex.ssl.truststore.path`).
  +Must be either `jks` or `PKCS12`. If the truststore path ends in ".p12", ".pfx"
  +or "pkcs12", this setting defaults to `PKCS12`. Otherwise, it defaults to `jks`.
  +
  +`reindex.ssl.verification_mode`::
  +Indicates the type of verification to protect against man in the middle attacks
  +and certificate forgery. 
  +One of `full` (verify the hostname and the certificate path), `certificate`
  +(verify the certificate path, but not the hostname) or `none` (perform no
  +verification - this is strongly discouraged in production environments).
  +Defaults to `full`.
  +
  +`reindex.ssl.certificate`::
  +Specifies the path to the PEM encoded certificate (or certificate chain) to be
  +used for HTTP client authentication (if required by the remote cluster)
  +This setting requires that `reindex.ssl.key` also be set.
  +You cannot specify both `reindex.ssl.certificate` and `reindex.ssl.keystore.path`.
  +
  +`reindex.ssl.key`::
  +Specifies the path to the PEM encoded private key associated with the
  +certificate used for client authentication (`reindex.ssl.certificate`).
  +You cannot specify both `reindex.ssl.key` and `reindex.ssl.keystore.path`.
  +
  +`reindex.ssl.key_passphrase`::
  +Specifies the passphrase to decrypt the PEM encoded private key
  +(`reindex.ssl.key`) if it is encrypted.
  +Cannot be used with `reindex.ssl.secure_key_passphrase`. 
  +
  +`reindex.ssl.secure_key_passphrase` (<<secure-settings,Secure>>)::
  +Specifies the passphrase to decrypt the PEM encoded private key
  +(`reindex.ssl.key`) if it is encrypted.
  +Cannot be used with `reindex.ssl.key_passphrase`. 
  +
  +`reindex.ssl.keystore.path`::
  +Specifies the path to the keystore that contains a private key and certificate
  +to be used for HTTP client authentication (if required by the remote cluster).
  +This keystore can be in "JKS" or "PKCS#12" format.
  +You cannot specify both `reindex.ssl.key` and `reindex.ssl.keystore.path`.
  +
  +`reindex.ssl.keystore.type`::
  +The type of the keystore (`reindex.ssl.keystore.path`). Must be either `jks` or `PKCS12`.
  +If the keystore path ends in ".p12", ".pfx" or "pkcs12", this setting defaults 
  +to `PKCS12`. Otherwise, it defaults to `jks`.
  +
  +`reindex.ssl.keystore.password`::
  +The password to the keystore (`reindex.ssl.keystore.path`). This setting cannot be used 
  +with `reindex.ssl.keystore.secure_password`.
  +
  +`reindex.ssl.keystore.secure_password` (<<secure-settings,Secure>>)::
  +The password to the keystore (`reindex.ssl.keystore.path`).
  +This setting cannot be used with `reindex.ssl.keystore.password`.
  +
  +`reindex.ssl.keystore.key_password`::
  +The password for the key in the keystore (`reindex.ssl.keystore.path`).
  +Defaults to the keystore password. This setting cannot be used with 
  +`reindex.ssl.keystore.secure_key_password`.
  +
  +`reindex.ssl.keystore.secure_key_password` (<<secure-settings,Secure>>)::
  +The password for the key in the keystore (`reindex.ssl.keystore.path`).
  +Defaults to the keystore password. This setting cannot be used with 
  +`reindex.ssl.keystore.key_password`.
  
positive.code: * Each sub-request gets a slightly different snapshot of the source index,
  though these are all taken at approximately the same time.
  
  [float]
  [[docs-reindex-picking-slices]]
  ====== Picking the number of slices
  
  
negative.code: }
  ----------------------------------------------------------------
  
  [[docs-reindex-automatic-slice]]
  ====== Automatic slicing
  
  You can also let `_reindex` automatically parallelize using <<sliced-scroll>> to
  slice on `_uid`. Use `slices` to specify the number of slices to use:
  