De-dot filter to replace dots doesn't work when _source is disabled

Elastic Stack Elasticsearch
1

I have indices with field names containing dot in ES 1.0.2. So before upgrading to 2.3.3, i tried using de-dot filter to replace . with _. But it doesn't work as _source is disabled. Is there any alternative to de-dot filter when index doesn't have _source?

An other approach i tried is to use updateIndex API with below script filter, but that too relies on _source.

Script(ctx._source.first_Name= ctx._source.remove(first.Name))

Is there really no way to replace dot in field names other than building index with new set of mappings again?

2

You can reprocess the original events if you have them.

3

can you please explain in detail? original events as in ?

4

The files you processed them from.