I'm trying to update an existing topbeat-[YYYY-MM-DD] index to accept an updated index pattern.
I am doing this because the topbeat sample dashboard has issues with beat.name and beat.hostname showing up as analysed fields. The dashboards do not appreciate hostnames that contain a hyphen "-" them, if it is an analysed field. The result is that the dashboard shows multiple results (The issue is also reported in this thread). The index pattern in the sample dashboards release seems to contain an updated index pattern.
By deleting, and running the load.ps1 import script I am able to import the recommended/updated index pattern, but I understand that I need to update the indices themselves.
I have also checked how to update the indices settings, and seen this elastic article on how to do so using the REST API.
I am just wondering at this point, what JSON command(s) do I need to accomplish this.
Does anyone know the correct JSON required to update an existing index to inherit the updated index pattern, in particular the beat.name and beat.hostname fields?
NOTE: I'm still somewhat new to this, so if I'm barking up the wrong tree here, I'd welcome any pointers.
You can't change the mapping of existing fields without reindexing, i.e. creating a new index to which the existing data is copied, followed by a deletion of the old index. How to reindex data is a fairly common topic here (it has been covered in the past couple of days).
I also got some advice from @andrewkroh in the other topic here:
Thanks very much @andrewkroh, I'm going to investigate the possibility of reindexing, and if it proves too complicated/time-consuming/scary I may go with the original 'delete and create' solution (I'll chalk this one up to experience and better planning next time).
In the end I deleted all traces of the sample dashboards:
-Deleted all imported Searches
-Deleted all imported Dashboards
-Deleted all imported index patterns
-Deleted all imported Visualisations
When you recreated the index(es) after deleting them, did you make sure to mark the hostname field as not analyzed? The evidence suggests that it's still analyzed.
I don't believe I did that, no.
I thought the index patterns would be applied to the newly created indices?
The screenshot I provided shows in Kibana that the beat.hostname and beat.name fields are not analyzed.
Again, I could be misunderstanding what I'm looking at here.
Is there a way to manually mark them?
Update: I assume this is possible via the ES REST API, and I'm trying to determine what instructions I need, but REST API functions are where I'm unsure with ES.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.