Disable _source field from indexing

Elastic Stack Elasticsearch
1

Hi,

To reduce the size of an indice I decide not to store _source field in elasticsearch, but I got this error when I try to diable it.

PUT /myindice/_mapping
{
  "properties": {
    "_source": {
      "enabled": false
    }
  }
}

{
  "error": {
    "root_cause": [
      {
        "type": "mapper_parsing_exception",
        "reason": "Field [_source] is defined both as an object and a field"
      }
    ],
    "type": "mapper_parsing_exception",
    "reason": "Field [_source] is defined both as an object and a field"
  },
  "status": 400
}

Have anyone an idea what this error does mean ?

I can't get the _source field in the mapping with

GET /myindice/_mapping/_source

but if I get the details of size of fields it's there

POST myindice/_disk_usage?run_expensive_tasks=true

{"field":"_source","total":"10.6mb","tot":"bla",.....}
....

Regards.

2

Hi @Mhag

You cannot disable an existing index. Create a new index and reindex the data.
There are such effects when disabling _source.

3

Hi @RabBit_BR ,

Thanks for the link it's very helpful.

In my situation, Logstash creates the index at the output section. Is there a method to exclude this field when Logstash puts it into Elasticsearch?

output {
        elasticsearch {
                hosts => ["https://xxxxx:9200"]
                ssl => true
                ssl_certificate_verification => false
                index => "myindice-%{+YYYY.MM.dd}"
                user => "xxxxxx"
                password => "xxxxxxx"
        }
  }

Alternatively, should I create a template for the index with a specific mapping?

Best regards.

4

Since you are using daily indices you will need to have a template that will be applied when the index is created.

5

Thanks,

Is it possible to disable _source field without using mapping in logstash side ? something like :

  mutate {
    remove_field => ["_source"]
  }

This suppose we can ignore existing indexes with this field.

Regards.

6

You need to use a template, Logstash cannot do this for you.

7

No, this field does not exists in Logstash, it will be created by elasticsearch when it receives an indexing request.

The only way to disable the _source field is using a template that will set it to false.