Hi all,
I'm trying to update an existing topbeat-[YYYY-MM-DD]
index to accept an updated index pattern.
I am doing this because the topbeat sample dashboard has issues with beat.name
and beat.hostname
showing up as analysed fields. The dashboards do not appreciate hostnames that contain a hyphen "-" them, if it is an analysed field. The result is that the dashboard shows multiple results (The issue is also reported in this thread). The index pattern in the sample dashboards release seems to contain an updated index pattern.
By deleting, and running the load.ps1
import script I am able to import the recommended/updated index pattern, but I understand that I need to update the indices themselves.
I have also checked how to update the indices settings, and seen this elastic article on how to do so using the REST API.
I am just wondering at this point, what JSON command(s) do I need to accomplish this.
Does anyone know the correct JSON required to update an existing index to inherit the updated index pattern, in particular the beat.name
and beat.hostname
fields?
NOTE: I'm still somewhat new to this, so if I'm barking up the wrong tree here, I'd welcome any pointers.