You cannot rename the source type for data that has already been indexed. You can do some things at search time, but since that is inefficient I won't go into it. Your best bet is likely sending the data feed to a heavy forwarder, setting the source types appropriately (inputs, props, transforms), and then kicking it to the indexers. ... View more

What commonality do the failing containers have with other failing containers, and how do the differ from containers that do not fail? ... View more