# Default Filebeat index pattern

**URL:** <https://discuss.elastic.co/t/default-filebeat-index-pattern/200314>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 19, 2019, 9:43pm UTC](https://discuss.elastic.co/t/default-filebeat-index-pattern/200314 "2019-09-19T21:43:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Roman\_Kournjaev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roman_kournjaev/32/2552_2.png) [@Roman\_Kournjaev](https://discuss.elastic.co/u/Roman_Kournjaev)\
**Post date:** [September 19, 2019, 9:43pm UTC](https://discuss.elastic.co/t/default-filebeat-index-pattern/200314/1 "2019-09-19T21:43:38Z")

</div>

Filebeat creates a huge index pattern when with over a 1K fields in it when its connected the first time to ES/Kibana. WIth all the field for all the modules. Is there a way to disable it and to create an index pattern only for the fields i am sending without providing an index pattern explicitly to its configuration ?

For instance it will an field like that "cisco.asa.connection\_id"

Thanks

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [September 20, 2019, 5:45am UTC](https://discuss.elastic.co/t/default-filebeat-index-pattern/200314/2 "2019-09-20T05:45:05Z")

</div>

Hi @Roman_Kournjaev I am a little unclear what your concern is or what you want to accomplish? The index pattern is dynamic so the the actual filebeat data that is indexed / stored only contains the fields that are actually sent from the filebeat for the modules you enable... The size of the template is / will be negligible compared to the actual data.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 18, 2019, 5:58am UTC](https://discuss.elastic.co/t/default-filebeat-index-pattern/200314/3 "2019-10-18T05:58:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.