Inputs don't "touch" indexes at all. The only dependency is that after processing the input, when the data is sent further down the pipeline for parsing/forwarding/indexing it can have the metadata field specifying destination index set. That's all. So you can freely add, change, remove inputs and nothing will hapen to the indexes themselves and data already indexed. I don't know what you mean by "add fields to the stanza of indexed file". If you mean field extractions then no, yiu don't have to touch indexes either if you're defining new field extractions. In fact newly defined search-time extractions will work on already indexed data. And you don't define extractions per index. You define them per sourcetype, source or host pattern. It's not a RDBMS. 😉
... View more
