How do I change a Custom Schema field type in Panther?
QUESTION
How do I change the inferred type of a custom schema field in Panther? What should I do when I have a mis-typed schema field?
ANSWER
You cannot change a schema field type, due to backwards compatibility. To correct a mistyped schema field, create a new schema with the fields correctly typed. Adjust any affected log sources to start using the new schema. Any newly ingested logs will now be correctly typed, but previously ingested logs will maintain the old types.