I have an ELK stack, up and running. Logstash ingest log perfectly but, I forgot something when I did a grok pattern, and I have a list of field that are consider string, but really they are float. I have approx 1To of data. My question is how can I change the type of this field ? I think I need to re-index. But I'm not sure how ? Is doing it with reindexmethod with elasticsearch-py help ? Can I do it like that :
take logstash-{DATE}, re-index in logstash-{DATE}-reindex with the correct field type
once done suppress logstash-{DATE}
reindex from logstash-{DATE}-reindexto logstash-{DATE}
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.