Hi,
You're right, you cannot apply a template on an existing index, it applies only at index creation time. But that's not a show-stopper, even if you want to keep your data.
First, you can choose your index name in the output (and even apply a date pattern - optionally)
output {
elasticsearch{
hosts => ["http://192.168.3.8:9200"]
index => "myindex-%{+YYYY.MM.dd}"
}
}
Specifically for your case, this should work:
- create the index pattern you need (I recommend you read up a bit on this, you may need more than my snippet) - use Kibana DevTools, it's easy to work from there.
- stop logstash
- modify logstash output with your new index name, then restart logstash
If you need the data you already have in elasticsearch, you can take it from the logstash index and move it in your new index, using the Reindex API.
This is fairly easy to use:
POST _reindex
{
"source": {
"index": "logstash-*"
},
"dest": {
"index": "myindex"
}
}