Is this possible?
I need to re-index some data because of a template update. Sadly, the old index holding all this data has a field that ES now wants to parse as a DateTime, except it's mis-formatted. We've fixed the producer, and new data is happily accepted in the new index, but of course I'm left unable to simply copy the data from the old index into the new index without repairing the value of this field first.
If I could say, "for each document in the index, update it by putting the value of _timestamp into the message.DateTime field", that would be great. I could then copy the data into the new index.
Any examples on how to do this would be good to see.
Thanks,
James