Greetings, I'm unable to add a custom analyzer "tokenizer" to an existing, up and running index. I'm able to add the same custom analyzer creating a new index and reindexing an old one to a recently created one. However, this configuration does meet our requirement because data of the filebeat will continue arriving in the old index.
PUT filebeat_new
{ "mappings": {
"properties": {
"my_text": {
"type": "text",
"analyzer": "my_custom_analyzer2"
}
}
}
}