I want to delete my main Index pattern but what will be consequences?

[Kwiskas]

Hello
on my Kibana I have a few index patterns to categorize logs when they are sent from logstash
I have a global index pattern named filebeat-*
I have other inde patterns named this way: filebeat--myappname-
So the index get their own pattern regarding the app and the filebeat sending the logs

My main pattern has some issues: too much fields on it due to kv_filter error not blocked by logstash and other grok_parse errors

I fixed the issue from logstash and want to refresh the fields on my main index pattern, so i had the idea to delete it and recreate it

my question: what happens if i do this? Do the visualize, discover, and dashboard connected to filebeat-* will use the new filebeat-* or will it consider it as not the same index pattern and i will have to modify them all?

Thank you

[thomasneirynck]

hi @Kwiskas,

you do not need to delete your index-pattern if the title of the indexpattern remains the same (so in your case filebeat*). On the IndexPattern-page in Kibana, select your index-pattern, there's a refresh-button near the top-right. Click that one, and all the fields will refresh based on the new mapping in your Elasticsearch-index.

The answer is yes btw. Some saved objects (e.g. visualizations etc...) are linked to an internal-identifier of that index-pattern, so deleting it will break those.

[Kwiskas]

Hello
Thank you for the answer
This is what I was looking for. I know i can refresh field list but due to some issues with our kv_filter a lot of stupid stuff came and filled with a lot lf bad things our field list on the index. it increased from 3k to 23k in two weeks and we didnt noticed it.
So now i cannot anymore refresh field list without having to delete it

Thanks for the reply