Delete unnecessary mappings from a given index

Elastic Stack Elasticsearch
1

Hi,

I have an index template called "suricata-ids" created by default from Filebeat. This index template has many fields that are simply not used by the suricata logs. How can i delete that unnecessary fields? Is it possible? It improves performance?

Thanks you

2

It's not worth deleting extra fields for older indices. You should look at customising the index template to remove the fields you don't want for future indices.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.