Default Filebeat index pattern

[Roman_Kournjaev]

Filebeat creates a huge index pattern when with over a 1K fields in it when its connected the first time to ES/Kibana. WIth all the field for all the modules. Is there a way to disable it and to create an index pattern only for the fields i am sending without providing an index pattern explicitly to its configuration ?

For instance it will an field like that "cisco.asa.connection_id"

Thanks

[stephenb (Stephen Brown)]

Hi @Roman_Kournjaev I am a little unclear what your concern is or what you want to accomplish? The index pattern is dynamic so the the actual filebeat data that is indexed / stored only contains the fields that are actually sent from the filebeat for the modules you enable... The size of the template is / will be negligible compared to the actual data.