In last two days,I search in google and looking for information in www.elastic.co,but I still feeling puzzled.Here is my actual situation:
I learn and set up ELK services at last month.I import my logs to elasticsearch via logstash.
But I got a problem when I make visualization chart,I need sum a field to do that,but I got error:
this field type is string,need number to sum!
A number is required to calculate the sum,this makes sense,so I try change the field type from string to number(long).
And I maked that,here is my solution:
post a template to elasticsearch and create new index
set logstash output to new index and restart it
reindex old index to new one
delete old index
Here is my question:
Can I skip the second step?
I don't want to restart logstash,because it receive data in real time and I don't want it miss some data.
If I dont't restart logstash,I can't change output to new index.
It makes me confused.