Is it possible to refresh an index pattern and only add fields? We retire old logs somewhat aggressively, so if we refresh during a period where there are no logs with a given field, it will get removed from the pattern. This ends up breaking visualizations.
What's the best way to avoid something like this?
Unfortunately, I don't see a way to avoid this with your current workflow. There is a GitHub issue that covers this and some other pain points. You may wish to add your use case to that issue.
Thanks, I'll leave a comment there.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.