Hi folks, i accidently added winlogbeat event fields to logstash-* index and want to remove them. I don't have any logstash-* data using the fields as I deleted those events.
How can I remove the unused fields?
use curator can delete as you know.
Hi,
This might push you in the right direction.
@pjanzen Doesn't this assume there's documents that use the fields I want to delete? I don't have any documents using those fields, I've long ago deleted them.
If the fields are not used you can make a new mapping for a new index and reindex the data to that new index, delete the old index and reindex the data back to the original name.
About the link, there is explained how to removed a used field. More then that I cannot elaborate.
update the mapping for new docs, or update the old docs with update api.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.