I got a query which creates a new field sophos.utm.to.domain. That query extracts the full mail domain. The mail address which is stored in sophos.utm.to. My Question: How do I create a new field out of this query? [2021-02-10_163740]

Create new field from query

javanna (Luca Cavanna) February 16, 2021, 9:32am 17

Index templates don't take effect on existing indices. In that case you need to do a put mapping call against the existing indices. Is your intention to add the same runtime field to existing indices too?

Cheers
Luca

Topic		Replies	Views
Map runtime field Elasticsearch	2	335	March 19, 2021
Mapping modifications in index template breaks search queries Elasticsearch	18	498	July 6, 2017
Adding new fields showing Error Elasticsearch	3	429	July 6, 2017
Add/Remove fields to/from existing index Elasticsearch	4	481	July 6, 2017
Urgent :adding fields mapping for nested document property Elasticsearch	13	463	July 6, 2017

Create new field from query

Related topics