AuditLog fix index mapping step by step

Owned by Вагнер Денис
Last updated: Feb 18, 2020
5 min read

  1. Create New index with correct mapping

    PUT /INDEX_COPY { "mappings" : { "properties" : { "id": { "type": "keyword", "ignore_above": 256 }, "actor": { "properties": { "group": { "type": "keyword", "ignore_above": 256 }, "id": { "type": "keyword", "ignore_above": 256 }, "name": { "type": "keyword", "ignore_above": 256 } } }, "description": { "type": "text" }, "app": { "properties": { "build": { "type": "keyword", "ignore_above": 256 }, "name": { "type": "keyword", "ignore_above": 256 }, "server": { "type": "keyword", "ignore_above": 256 }, "stage": { "type": "keyword", "ignore_above": 256 }, "version": { "type": "keyword", "ignore_above": 256 } } }, "entity": { "properties": { "group": { "type": "keyword", "ignore_above": 256 }, "id": { "type": "keyword", "ignore_above": 256 }, "name": { "type": "keyword", "ignore_above": 256 } } }, "changes": { "type": "nested", "properties": { "name": { "type": "keyword", "ignore_above": 256 }, "created": { "type": "date", "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd" }, "ip": { "type": "keyword", "ignore_above": 256 }, "groupId": { "type": "keyword", "ignore_above": 256 }, "groupName": { "type": "keyword", "ignore_above": 256 }, "newValue": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "oldValue": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } } } }, "request": { "properties": { "ip": { "type": "keyword", "ignore_above": 256 }, "timestamp": { "type": "date" } } } } } }

  2. Move data from old index to copy

    POST _reindex { "source": { "index": "INDEX_NAME" }, "dest": { "index": "INDEX_COPY" } }

  3. Remove old index

    DELETE /INDEX_NAME

  4. Assign original index name as alias to new index with correct mapping