What is the recommended way to add a field after the log is collected into elasticsearch?
Situation is that lets say at first you are unsure which fields you want to use in the visualize but just want to collect logs. But after a while you find out the field you want to parse.
Of course amending logstash configuration is the best way but I am seeking any other efficient way to do it.