Uploaded image for project: 'logstash'
  1. LOGSTASH-2261

Remove unneeded fields in elasticsearch template

    Details

    • Type: Bug/Feature
    • Status: Resolved (View workflow)
    • Resolution: Won't Fix
    • Affects versions: None
    • Fix versions: None
    • Labels:
      None

      Description

      Dear support,

      We use ELK stack on a single node which aims to ingest and store different logs from a bunch on servers. I'm stuck about mappings.
      There are some automatically generated fields among all documents which I want to get rid of:
      "_type"
      "_score"
      "@version"
      etc.

      I tried to create a template to remove this fields but they are retained
      Template where I want to disable @version field:

      {
      "order" : 2,
      "template" : "logstash-*",
      "settings" :

      { "index.number_of_replicas" : "0" }

      ,
      "mappings" : {
      "default" : {
      "dynamic_templates" : [ {
      "string_fields" : {
      "match" : "*",
      "match_mapping_type" : "string",
      "mapping": {
      "type": "multi_field",
      "fields":{
      "raw" :

      {"index" : "not_analyzed", "ignore_above" : 256, "type" : "string"}

      ,
      "

      {name}

      " :

      {"index" : "analyzed", "omit_norms" : true, "type" : "string"}

      }
      }
      }
      }
      ],
      "properties" : {
      "@version":

      {"enabled" : false}

      }
      }
      }
      }

      After I recreate new index but eventually this field still exists:

      "@version" :

      { "type" : "object", "enabled" : false }

      ,
      "agent" : {
      "type" : "string",
      "norms" :

      { "enabled" : false }

      ,
      "fields" : {
      "raw" :

      { "type" : "string", "index" : "not_analyzed", "ignore_above" : 256 }

      }
      },

      What am I doing wrong? Thanks ahead
      Sergey

        Gliffy Diagrams

          Attachments

            Activity

              People

              • Assignee:
                Philippe Weber
                Reporter:
                Sergey Zemlyanoy
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: