Dealing with dots in fields for the 2.0 upgrade

Man I wish I could tell you this were easier.

First a moment of background. From a Logstash perspective, Aaron wrote a stickied post over here about it. They added a 'de_dot' filter to help with situations where you may not have control over the source fields. Dots in field names also caused problems in Kibana. And they could cause really weird problems with field ambiguity, as seen here. Ugh... what a mess ever allowing them caused.

I know none of that helps your current situation, because the unfortunate answer is you're going to have to reindex. This is one of those breaking changes that just had to happen. We looked into ways to simplify the process to avoid a reindex or do it in place, but the options just weren't tenable unfortunately.

A few of the elasticsearch clients do have "reindex" functions built in. I've written this script which uses the perl reindex API, which you can see as an example.