Simple way to reindex a field type?

Elastic Stack Elasticsearch
1

Say I have a bunch of daily log indices, created with Logstash dynamic templates, where one field has inconsistent datatypes over a span of a couple of weeks.

Is there a way to:

  1. Create new indices (i.e. logstash-yy.mm.dd-01) without having dynamic templates apply mappings
  2. Reindex old -> new indices, keeping the mapping except changing the incorrect field type to the correct one?
2

1 - create new index name with different from logstash-* name (assuming you have something like that)

# curl --silent localhost:9200/_cat/templates | grep logstash
logstash   logstash-*   0 50001
#

2 - Reindex API

1 Like
3

Thanks alexus; I was hoping to get a little more guidance in using the Reindex API - can I use that to zone in on the incorrectly mapped field and change it, or do I need to specify the correct field in a template / dynamic template?

4

Create index and set Mapping or do it via templates, then Reindex API...

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.