Graylog 4 - pipeline regex causes lost messages?

You can rotate the index and it will take the new type as long as the new type for that field is the first thing that gets inserted into the new index… You can create a custom index map to make sure.

If you want to correct old indexes - I made a post a while back about it here

Note that my post was doing it in an older version of elastic (6.8 I think) so take that into account.