Change a type in the index


#1

Hello,
I'm a beginner at ElasticSearch. I'm having a big confusion.
I have got log lines, i parsed them via grok filter. the Date type in index was string.
I asked how to chage it to date. i was told to reindex it. i read the documentations below:

I didn't get how exactly to manipulate the mapping ? shall i map every field and then parse logs via logstash's filter grok or what ?


(Alexander Reelsen) #2

The idea here is not to change the mapping of an existing index (as this is not possible like changing a string to a date), but create a new index fix a fixed mapping and then use the reindex API to reindex the existing content into that new index with the new mapping being applied.

Hope this makes more sense.


#3

thanks @spinscale for your response.
I know how to create a new index, but how exactly could i set its mapping to make the date a "DATE" type and not a "STARING"?


(Alexander Reelsen) #4

See https://www.elastic.co/guide/en/elasticsearch/reference/7.0/date.html