How to replace field with another field value for entire index?


(Bhavik Chitroda) #1

Hi, I am new to Elasticsearch and still trying to figure the APIs for update and modifying documents/data on elasticsearch indexes.

I forwarded certain logs from Logstash to ES indexes. My logstash file is pretty complex and has multiple parsers. I forgot to use date filter for a set of logs. Now I have 10k logs showing in Kibana with wrong @timetamp value. I have a field called "createdOn" that I want to use as @timestamp

How can I replace the value of @timestamp with createdOn field for all logs in that index without resending the logs from logstash?

Please help.

Thank you