Change the type of a field

Elastic Stack Elasticsearch
1

Hi everyone,

I have an ELK stack, up and running. Logstash ingest log perfectly but, I forgot something when I did a grok pattern, and I have a list of field that are consider string, but really they are float. I have approx 1To of data. My question is how can I change the type of this field ? I think I need to re-index. But I'm not sure how ? Is doing it with reindexmethod with elasticsearch-py help ? Can I do it like that :

  • take logstash-{DATE}, re-index in logstash-{DATE}-reindex with the correct field type
  • once done suppress logstash-{DATE}
  • reindex from logstash-{DATE}-reindexto logstash-{DATE}

In advance thanks

2
  • Take logstash-{DATE}, re-index in logstash-{DATE}-reindex with the correct field type
  • Once done suppress logstash-{DATE}
  • Reindex from logstash-{DATE}-reindexto logstash-{DATE}

If you require the addition of a new field value and you want to close the older (missing field) index, you will need to index. Correct. For reference: https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html