Preferred way to set the 'final_pipeline' back to '_none' for all indices

Elastic Observability Logs
1

Hello, Elastic!

As the title implies, I was wondering if there's a preferred way to set the 'final_pipeline' back to '_none' for all indices.

Originally, I set the final pipeline to point at an Ingest Pipeline that used regex redactor Processors via a Component Template tacked on to the end of our log's Index Template. After determining that the regex redaction wasn't going to meet our PII redaction requirements, I backed the change out by deleting the Component Template that explicitly set the final pipeline.

However, a large number of indices had auto-rolled over and picked up the final pipeline setting change. After backing out/deleting my Component Template from our logs Index Template and manually rolling over a couple indices, I noticed that the final pipeline setting is still set.

It looks like the final pipeline needs to be explicitly set back to none, but what I don't want to do is to have to manually run a POST command that sets that setting for each index (we have hundreds of them).

What I was thinking on doing is adding back a Component Template that explicitly sets the final pipeline back to none and then just waiting for the indices to auto-roll over again. I would like to know if this is an acceptable way to essentially reset the final pipeline setting back to none for all indices, or if there's a better way to do that.

Thanks in advance!

Adam

2

you can use wildcards

POST my-index-1/_doc
{
  "foo" : "bar"
}

POST my-index-2/_doc
{
  "foo" : "bar"
}

PUT /my-index-*/_settings
{
  "index.default_pipeline": "test"
}

GET my-index-*/_settings

PUT /my-index-*/_settings
{
  "index.default_pipeline":  null
}

You can also us the _all directive to apply settings to all indices that you have access to... CAUTION do not make a misake!!!

PUT /_all/_settings
{
  "index.default_pipeline":  null
}
1 Like
3

Great, I'll try that. Thanks for the reply, @stephenb!