Hi, We having a requirement to change one field data type from text to some numeric and also adding a new field. We are using logstash with day rotation for indexes. Is it okay to change the data type as well as new field to an existing index? I noticed the new field immediately get reflected in the current write index and the data type change on the new index created on the following day which is ok. Would this cause any problem in search when search area span across different type(new field/different type) of index but belongs to same pattern? or should i create a new index pattern?
Thanks for reaching out here, @basiltitus.
I've found this guide helpful for learning about changing field types, which might be a good starting point here.
For new ingest sources, I often updated the index template, then forced a roll-over. The new mapping will be applied to the "new" index.
The older indices can be re-indexed if necessary.
Ingest and field mapping takes "development" 
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.