No, this field does not exists in Logstash, it will be created by elasticsearch when it receives an indexing request.
The only way to disable the _source field is using a template that will set it to false.
1 Like