In our elasticsearch dEV instance, the indexes are getting created like "appid-2018.01.02", "appid-2018.01.05 " ( appid-yyyy.mm.dd format) - one index for each day's data.
In a few indexes, one of the field - logdate - is being taken as 'date' and in others the type of this field is being taken as 'text'. we would like to have this as 'text'.
I figured out that we need to define a new mapping template and recreate indexes.
I am trying the below steps., after creating a new template
- find out which of those idexes where logdate is of type date
- create a duplicate index using "POST _reindex " (e.g. for appid-2018.02.03, the duplicate index will be created as appid-new_2018.02.03)
- delete the old index (appid-2018.02.03)
- create a duplicate again using POST _reindex (appid-2018.02.03 will be created with appid-new
-2018.02.03 as source)
This seem to work fine. the newly created index has the logdate as 'text' type.
But it is tedious to do this for all the indexes, one by one.
May i please know if there is any way that i can do this in a bulk . Say like all the indexes like "appid-2018*" should be reindexed after applying the new template.
using logstash 5.1.2
many thanks in advance !