Thanks, great work! I have a few questions about some points of the blog post:
-
If I have multiple indexes (for example "logstash-YYYY.MM.DD"), can I do the same thing using as index "logstash- *" or do I have to reschedule the logstash input for each index?
-
If I don't have a new cluster, but I work on one as input and output, I will overwrite the old data or the data will be duplicated?
You talk about "first creating the mapping we want to apply before indexing any date", but considering the above (multiple indexes and clusters already existing), I can do the same this step?