Hi. I tried to disable field _source using mapping like this
curl -XPOST localhost:9200/test1 -d '{
"mappings" : {
"test1" : {
"_source" : {
"enabled" : false
}
}
}'
When data is loaded to elasticsearch with logstash, there are only 3 fields with any text:
_id _type and _index. Other fields with data are missing.
But when i parse my logs , there are at least 6 fields.
Did someone has problems like this?