Delete unnecessary mappings from a given index


I have an index template called "suricata-ids" created by default from Filebeat. This index template has many fields that are simply not used by the suricata logs. How can i delete that unnecessary fields? Is it possible? It improves performance?

Thanks you

It's not worth deleting extra fields for older indices. You should look at customising the index template to remove the fields you don't want for future indices.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.