Filebeat creates a huge index pattern when with over a 1K fields in it when its connected the first time to ES/Kibana. WIth all the field for all the modules. Is there a way to disable it and to create an index pattern only for the fields i am sending without providing an index pattern explicitly to its configuration ?
For instance it will an field like that "cisco.asa.connection_id"
Hi @Roman_Kournjaev I am a little unclear what your concern is or what you want to accomplish? The index pattern is dynamic so the the actual filebeat data that is indexed / stored only contains the fields that are actually sent from the filebeat for the modules you enable... The size of the template is / will be negligible compared to the actual data.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.