How do I change the inferred type of a custom schema field in Panther? What should I do when I have a mis-typed schema field?
You cannot change a schema field type, due to backwards compatibility. To correct a mistyped schema field, create a new schema with the fields correctly typed. Adjust any affected log sources to start using the new schema. Any newly ingested logs will now be correctly typed, but previously ingested logs will maintain the old types.