We collect a great amount of logs from our systems. These logs are already stored in a field "message" as a normal string message.
I now added (via logstash filter) a field which is a very specific log with timing info i.e. "Process took 23s". The field will be named ProcessTimeInS and as value an integer with the amount of time it took.
This logline existed before so it should be in the "index.message" log lines (I can search for it in kibana and I get hits). If I understand correctly, when I reindex (using this method, is this field then enabled / filled for historic data?
If not, how do I make use of this new field for old data?
Thanks and apologies for the seemingly silly question.