If anyone should stumble here, I was able to force solve it by manually cycling the deflector and keeping the query range within the creation time of the new index. This may (probably) cause issues later but in proof of concept phase, it doesn't matter. I have finally been able to win over management - the PoC is a success.
On Friday, August 26, 2016 at 5:22:50 PM UTC+10, Jochen Schalanda wrote: > > Hi, > > you can't change the types of a field in an existing index. The schema has > to be defined up-front. > I couldn't find that statement anywhere in the documentation. Or even words to it's effect. But I believe it would aide newcomers significantly if it _was_more clearly stated, especially w.r.t. getting the VM up and running and producing what management want to see from a limited time pilot now - rather than the "Wait till tomorrow boss. And hope we don't make the same mistake again, else you'll have to wait till the next day...lather, rinse, repeat" scenario. That makes it hard to sell and makes mgmt believe other products are more likely to be capable of (what they perceive to be) such a simple thing. > I'm pretty sure you want to read > http://docs.graylog.org/en/2.0/pages/configuration/elasticsearch.html#custom-index-mappings > . > Reading that without knowing the former point is, hmm, not overly helpful when trying to get a POC up and running quickly. Obviously there is a lot of domain knowledge to gain which is tricky at the POC stage, like you MUST click that Add button next to the conversion in the extractor creation. Thanks for trying to help anyway. -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/909aa885-bd14-4f96-9c97-e0ad48e399cf%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
