How do I re-index when I'm using logstash to apply an index template

[red888 (red der)]

This is the output section of my logstash config:

output {
  if [type] == "syslog" {
    elasticsearch {
      hosts => myserver
      index => "logstash-syslog-%{+YYYY-MM-dd}"
      template_name => "MyTemplateIWantToEdit" 
      template => "/etc/my/template/blah"
      template_overwrite => true
    }
  }

I do this to apply my templates to indices logstash is forwarding to and it works great.

But now I want to edit one of my templates. What will happen when I modify a template I have logstash applying to an index? Will that cause Elasticsearch to reindex the whole index or create a new index?

I was almost tempted to just edit a template and restart logstash to see what happens, but I don't wanna break anything!

Also, I'm using logstash to create new indexes via "logstash-syslog-%{+YYYY-MM-dd}". Not sure how this would impact re-indexing

[magnusbaeck (Magnus Bäck)]

But now I want to edit one of my templates. What will happen when I modify a template I have logstash applying to an index?

Upon the next Logstash restart, Logstash will post the updated template to ES and the next time an index is created the new template will be applied (to that index only).

Will that cause Elasticsearch to reindex the whole index or create a new index?

No.