I'm currently using a modified index template for filebeat. I have data ingesting with the indexs rolling daily based on data. The fields are coming from logstash grok. I want to parse some additional fields and want that field to be indexed. If I try to post the template via curl it says template already exists. I'm fine if old logs don't have that index but I would like the newly created indexes to use an updated template (i.e. I've added a new field called field.environment).
Do I need to just delete the existing template and add the new template and elasticsearch will pick it up when it rolls over to the next day or is there something else I need to do?