Technically, you can probably do this with a little scripting and the script_fields functionality:
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-request-script-fields.html However, Kibana does not expose this at the moment so for now, you'll need to produce the exact field values at index time. And yes it will not apply to already indexed data as you discovered - you will need to delete those old indexes and then re-run the logs again using your new LS config file if you want the values from the old logs. Btw, incase you've not seen this, there is a nifty grok debugger here (makes grokking and testing a lot quicker): http://grokdebug.herokuapp.com/ -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/8f8ba448-6330-4b4f-9410-14454845b6b7%40googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
