Deleting field mapping

[m-o-t-h]

Elastic/Kibana vs: 6.7.1

I'm searching for solution for fixing mapping explosion in index pattern. Indices under this contains logs from Winlogbeat. There is one problematic field: Pipelineexecutiondetailsforcommandline, which I guess because of wrong parsing creates thousands of subfields, for example: Pipelineexecutiondetailsforcommandline:$Module

Pipelineexecutiondetailsforcommandline:$PublishedDate

Pipelineexecutiondetailsforcommandline:$TestFileCatalogResult, etc,

some of them contains hardcoded data. I can disable totally this field from mapping in the future (but it can't be performed on Logstash, all information have to stay).

Some additional info:

1. There are many indices (present and from past) which I use under the same index pattern.

2. New indices are created using ILM rollover mechanism.

3. I know mapped field can't be deleted.

4. I know about reindexing, but there are too many indices to perform this action.

5. Dynamic mapping is ofc enabled. I want to stay this way, but only figure out how to erase problem with this one field and its subfields.

6. I was wondering if matching name of this field using "match", some sort of regex and setting "enable:false" in _template will do the work?

In summary, I assume if solution exist it can only be applicable to newly created indices, but I don't know what steps to perform or what to check next. Also, if some solution will do the work and mapping will be fixed, what about index pattern for future indices? They [indices] will have the same name convention as before (for example: now is: winlogbeat-2020-*, which match indices names) and I would like to stay this way.
What are my possibilities?

If you need any more information I will try to deliver it as soon as possible.

Thank you in advance.

[Larry_Gregory]

Hey @m-o-t-h, welcome to the discussion boards, and thanks for your detailed question!

There's unfortunately now a whole lot I can recommend for your particular scenario. I see you're running version 6.7.1. Version 7.3.0 introduced a new flattened data type, which would treat these dynamic fields as keywords, thereby reducing the number of fields in your mapping. If you're able and willing to upgrade, then that might be a viable option for you.

Since this question is geared more towards index mappings, as opposed to Kibana's index patterns, I'm going to move this to the Elasticsearch topic, so that the experts over there can take a look too.

[m-o-t-h]

Hi! For now, upgrade to higher version is not possible, at least to June/July - so I'll be grateful for help with some kind of temporary solution.

(I want to point out, I'm newbie in Elastic/Kibana, but I try my best ;)).