I realize that Graylog does not support re-index out of box.
I have found a method that seems to be working, and would like to get feedback from the Graylog folks if there are any potential issues with the approach.
If not, the steps below could help others who need to reindex after changing data mapping.
Go System | Indices | the index in question (in this example 7d)
Identify the lowest / highest indexes in current window (in this case 7d_204, 7d_210)
(in this example, we’re re-indexing the lowest entry and moving upwords)
Temporarily increase the number of indices that are kept in rotation so that while creating a copy index, the last index is not deleted.
(You can lower this back after you are done)
Use this as template to copy the lowest index to highest index + 1
curl -XPOST ‘localhost:9200/_reindex?pretty’ -H ‘Content-Type: application/json’ -d’
Run the script
Verify to make sure the destination index message count matches or is greater than the source index message count.
Delete the older index after confirming that the messages from that index are appearing twice.
Repeat & Rinse for the next index (7d_205 mapped to 7d_212) , …
Revert the changes made in step 3.