Mapping

Elastic Stack Elasticsearch
1

Logstash creates datestamped indexes, syslog-2020.11.17 etc, so I have an index for each day.

I use kv filter to parse data.

The syslog source sends different parameters depending on event type, so the index pattern Fields grow as time goes on, currently 312 Fields (one Field and one Field.keyword).

Therefore, after a while, I'd like to change the type of a Field from i.e. String to Number, to enable sums and average aggregates.

But it seems overly complicated to do so...

For what I've found, reindex is the only solution: https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html

I don't mind stopping logging or deleting indexes, I just want the index pattern to use a Field type.

Can I download the Index Pattern JSON, change the types, and upload it?

Please help me out... Thank you for your support!

2

Kind of. You can download it, optimise it and then upload it as an index template. This means that future indices will use that mapping.

For existing indices, if you want this to apply you will need to reindex.

3

Thank you very much! Works perfectly with index template.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.