I currently have daily indices (lets say logstash-*). I want to add new fields to the index mapping. After pushing the new template, the newly added fields do not become searchable for the entire index pattern. I guess this is because the older indices did not have the new field. Is there a work around? Can alias be used to overcome this ?
The thing that I would like is that when I create a filter for new field, I am fine with the search returning results only for the new indices.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.