CODEWITHSUNDEEP
elasticsearchlogstashkibanaelastic-stack
k. oth
k. oth

Reputation: 33

Update fields of logstash index on ElasticSearch

On ElasticSearch I have logstash index that are generated every day, I had changed the types of some of my fields, they had changed in the new indices that was generated but not on the old index. Knowing that I can not delete my old indices I want just the type of a field is changed on all existing indices. I show you on the following picture: the default mapping by a former logstash index with the fields "TMP_REPONSE" to string while it needs to be long, which is the case on the new index.

default mapping of an old index logstash

Thank you for showing me how I can solve this problem without removing the old indexs.

Upvotes: 1

Views: 624

Answers (1)

Val
Val

Reputation: 217564

You cannot change the type of a field from string to long after it's been indexed. You need to recreate the index with the correct mapping and reindex your data.

Once your new index is created with the right mapping, you can simply copy the date from the old index into the new one, for instance using the elasticdump tool or using Logstash

elasticdump \
  --input=http://localhost:9200/old_index \
  --output=http://localhost:9200/new_index \
  --type=data

Upvotes: 1

Related Questions