How do I re-index when I'm using logstash to apply an index template

Elastic Stack Logstash
1

This is the output section of my logstash config:

output {
  if [type] == "syslog" {
    elasticsearch {
      hosts => myserver
      index => "logstash-syslog-%{+YYYY-MM-dd}"
      template_name => "MyTemplateIWantToEdit" 
      template => "/etc/my/template/blah"
      template_overwrite => true
    }
  }

I do this to apply my templates to indices logstash is forwarding to and it works great.

But now I want to edit one of my templates. What will happen when I modify a template I have logstash applying to an index? Will that cause Elasticsearch to reindex the whole index or create a new index?

I was almost tempted to just edit a template and restart logstash to see what happens, but I don't wanna break anything!

Also, I'm using logstash to create new indexes via "logstash-syslog-%{+YYYY-MM-dd}". Not sure how this would impact re-indexing

2

But now I want to edit one of my templates. What will happen when I modify a template I have logstash applying to an index?

Upon the next Logstash restart, Logstash will post the updated template to ES and the next time an index is created the new template will be applied (to that index only).

Will that cause Elasticsearch to reindex the whole index or create a new index?

No.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.