Combined grok pattern for customized logs

This thread expands upon the problem.

You cannot change the type of a field in an existing index without re-indexing. And all the events need to be consistent about what type a field is.

1 Like