A Filebeat is delivering Data to Logstash and then to Elasticsearch.
Per default (dynmac mapping?), all Fields are of Type "text".
So i build a Mapping with the correct Types. I removed the Index, recreate it and push the mapping via api before indexing data.
The Problem is that these indizes how dates in their namen. Every Day a new Index is created.
How to make the Mapping apply to all of these indizes?
Have i create a Index Template and then a Policy Rule to map each other?