How to replace field with another field value for entire index?

Elastic Stack Elasticsearch
1

Hi, I am new to Elasticsearch and still trying to figure the APIs for update and modifying documents/data on elasticsearch indexes.

I forwarded certain logs from Logstash to ES indexes. My logstash file is pretty complex and has multiple parsers. I forgot to use date filter for a set of logs. Now I have 10k logs showing in Kibana with wrong @timetamp value. I have a field called "createdOn" that I want to use as @timestamp

How can I replace the value of @timestamp with createdOn field for all logs in that index without resending the logs from logstash?

Please help.

Thank you

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.