Having difficulty changing field type

Elastic Stack Elasticsearch
1

In Index Template I am trying to change my file field from type Text to type Keyword, however when I do this and save the settings I get this error:

Unable to create template
Failed to parse mapping [_doc]: Unknown value [positions] for field [index_options] - accepted values are [docs, freqs]

Any advice?

This is for my sysmon-* index pattern.

1 Like
2

As far as I know, if you add a new field it is ok, because new documents will be adapted with the new field.

But if you change an existing field, you must reindex the whole index.

1 Like