Disabled object fields appearing on fields list and being parsed on document detail

[mxandeco]

I have a template like:

{
"index_patterns": ["events-*"],
"mappings": {
  "properties": {
    "id": {
    "type": "keyword"
  },
  "topic": {
    "type": "keyword"
  },
  "name": {
    "type": "keyword"
  },
  "timestamp": {
    "type": "date",
    "format": "epoch_millis"
  },
  "data" :{
    "type": "object",
    "enabled" : false
  }
}
  }
}

And I can confirm my mapping for the index matches the template:

    "events-000005" : {
        "mappings" : {
          "properties" : {
            "data" : {
              "type" : "object",
              "enabled" : false
            },
            "id" : {
              "type" : "keyword"
            },
            "name" : {
              "type" : "keyword"
            },
            "timestamp" : {
              "type" : "date",
              "format" : "epoch_millis"
            },
            "topic" : {
              "type" : "keyword"
            }
          }
        }
      }

I was expecting kibana to completely ignore the "data" field, that can be a huge nested json, but it keeps showing me every single property from the object on the available list and if i open the document I can't see the the single property "data", it's expanding and showing each property individually.

the fields are not available on the index pattern, tried to refresh few times, it's like it's not really being indexed, but kibana insists in parsing that field somehow and expanding every single property.

Should I have being mapping it differently to prevent kibana expanding that field?

[mattkime (Matthew Kime)]

Which version of the stack are you using? Which license?

You can edit your index pattern to filter out specific fields with the 'source filter' tab - Create an index pattern | Kibana Guide [7.10] | Elastic

Discover is a bit different from other kibana apps as it shows unmapped fields. Its understandable that you were confused by this.

[mxandeco]

Kibana -> docker.elastic.co/kibana/kibana-oss:7.9.1
ES -> aws elastic service 7.9

I actually don't see any of those fields in the index pattern, as image attached. I don;t understand why discovery keep displaying them on the left side and on the document details, i would like to see a single "data" property, as configured in my mapping.

 "data" : {
              "type" : "object",
              "enabled" : false
            }

If I try to add data* or data.* to be excluded on the source tab I have the message " The source filter doesn't match any known fields."

Thanks for the help.