No mapping Found On [field] Sorting Issue

[Severin_Simko]

Hi,

I'm currently experiencing a problem when I'm trying to search based on some specific field, I'm seeing this error log:

Caused by: org.elasticsearch.index.query.QueryShardException: No mapping found for [process_id] in order to sort on.

I added a new custom mapping and rotated the indexes,

When I try curl -X GET 'http://localhost:9200/graylog_15/_search?pretty=true&sort='process_id'' (graylog_15 index was created after the rotation and contains the custom mapping for this process_id field) the problem is when I try to sort based on the same field in some old index.

Based on that I'm assuming that the custom mapping rules are only added to newly created indexes, so my question is: is it possible to update mapping rules for all old indexes so I can sort on logs that are included in old indexes?

My custom mapping.json looks like this:

{
"template": "graylog_9",
"mappings" : {
  "message" : {
    "properties" : {
      "winlogbeat_agent_type " : {
        "type" : "keyword"
      },
      "process_id" : {
      "type": "long"}
    }
  }
}
}