Hi @jochen,
Thanks for that so “current write-active index is graylog_5” and if I do this:
{
"template": "graylog_*",
"mappings" : {
"message" : {
"properties" : {
"protocol" : {
"type" : "string"
}
}
}
}
}
curl -X PUT -d @'graylog-custom-mapping.json' 'http://localhost:9200/_template/graylog-custom-mapping?pretty'
So from the documentation that looks like it will only effect new indexes and not the current index. When I look at the mapping for ‘graylog_5’ it has not changed so how to move forward?