# Disabling \_all-Field but keep Netflow-Events searchable **URL:** \ **Category:** Elasticsearch\ **Created:** [June 24, 2014, 10:39am UTC](https://discuss.elastic.co/t/disabling--all-field-but-keep-netflow-events-searchable/18288 "2014-06-24T10:39:01Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![german23](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/german23/32/11052_2.png) [@german23](https://discuss.elastic.co/u/german23)\ **Post date:** [June 24, 2014, 10:39am UTC](https://discuss.elastic.co/t/disabling--all-field-but-keep-netflow-events-searchable/18288/1 "2014-06-24T10:39:01Z")
Hey guys, I really want to disable the \_all-Field in the ES-Indices to save some disk-space on our system. Normally its not the problem - adjust template in ES, and set "message"-Field to the new default query field, that is normally available in any event. The problem is that we also have many netflow-events with the netflow-codec that have the following form: [https://lh4.googleusercontent.com/-CDQQs5e5a7o/U6lUvjikncI/AAAAAAAAACo/LHpMXlYLMWw/s1600/netflow.PNG](https://lh4.googleusercontent.com/-CDQQs5e5a7o/U6lUvjikncI/AAAAAAAAACo/LHpMXlYLMWw/s1600/netflow.PNG) As you might notice there isnt any "message"-field so the Kibana lucene query would run into an error. My question is - how do i manage it to make this work (disabling \_all-Field but search in the netflow-events)? Thanks for response. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/9ab09bba-392f-4f77-8937-aa518c22292f%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9ab09bba-392f-4f77-8937-aa518c22292f%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [June 30, 2014, 7:08am UTC](https://discuss.elastic.co/t/disabling--all-field-but-keep-netflow-events-searchable/18288/2 "2014-06-30T07:08:16Z")
Hey, you can set the index.query.default\_field in the mapping to circumvent this, see > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. --Alex On Tue, Jun 24, 2014 at 12:39 PM, horst knete [baduncle23@hotmail.de](mailto:baduncle23@hotmail.de) wrote: > Hey guys, > > I really want to disable the \_all-Field in the ES-Indices to save some > disk-space on our system. > > Normally its not the problem - adjust template in ES, and set > "message"-Field to the new default query field, that is normally available > in any event. > > The problem is that we also have many netflow-events with the > netflow-codec that have the following form: > > [https://lh4.googleusercontent.com/-CDQQs5e5a7o/U6lUvjikncI/AAAAAAAAACo/LHpMXlYLMWw/s1600/netflow.PNG](https://lh4.googleusercontent.com/-CDQQs5e5a7o/U6lUvjikncI/AAAAAAAAACo/LHpMXlYLMWw/s1600/netflow.PNG) > > As you might notice there isnt any "message"-field so the Kibana lucene > query would run into an error. > > My question is - how do i manage it to make this work (disabling > \_all-Field but search in the netflow-events)? > > Thanks for response. > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/9ab09bba-392f-4f77-8937-aa518c22292f%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9ab09bba-392f-4f77-8937-aa518c22292f%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/9ab09bba-392f-4f77-8937-aa518c22292f%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/9ab09bba-392f-4f77-8937-aa518c22292f%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAGCwEM9N1nEPEZi%3D%3DqA4\_FDDTjV\_twrAcNQZA57Hi1XvxW2OLg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAGCwEM9N1nEPEZi%3D%3DqA4_FDDTjV_twrAcNQZA57Hi1XvxW2OLg%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![german23](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/german23/32/11052_2.png) [@german23](https://discuss.elastic.co/u/german23)\ **Post date:** [July 1, 2014, 7:55am UTC](https://discuss.elastic.co/t/disabling--all-field-but-keep-netflow-events-searchable/18288/3 "2014-07-01T07:55:05Z")
Hey, thx for your response. As i already mentioned i tried setting the index.query.default\_field to "message". { "template" : "logstash-_", "settings" : { "index.refresh\_interval" : "5s", "index.number\_of\_shards" : 3, "index.number\_of\_replicas" : 0, "index.refresh\_interval" : "30s", "index.store.compress.stored" : true, "[index.store.compress.tv](http://index.store.compress.tv)" : true, "index.query.default\_field" : "message", "analysis" : { "analyzer" : { "default" : { "type" : "standard", "stopwords" : "none" } } } }, "mappings" : { "default" : { "\_all" : {"enabled" : false}, "\_source": { "compress": true }, "dynamic\_templates" : [ { "string\_fields" : { "match" : "_", "match\_mapping\_type" : "string", "mapping" : { "type" : "string", "fields" : { "{name}" : {"type": "string", "index" : "not\_analyzed"} } } } } ], "properties" : { "@version": { "type": "string", "index": "not\_analyzed" }, "@timestamp" : { "type" : "date", "index" : "not\_analyzed" }, "tags": { "type": "string", "index" : "not\_analyzed" } } } } } That was the template that i used. This is working fine for all Events except the Netflow ones, because they dont have a "message"-field for Kibana to search in. Thats what my mess is. Is it possible to adjust the template/mapping per type of event? Cheers Am Montag, 30. Juni 2014 09:08:22 UTC+2 schrieb Alexander Reelsen: > Hey, > > you can set the index.query.default\_field in the mapping to circumvent > this, see > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/mapping-all-field.html#mapping-all-field) > > --Alex > > On Tue, Jun 24, 2014 at 12:39 PM, horst knete \<[badun...@hotmail.de](mailto:badun...@hotmail.de) > \\> wrote: > > > Hey guys, > > > > I really want to disable the \_all-Field in the ES-Indices to save some > > disk-space on our system. > > > > Normally its not the problem - adjust template in ES, and set > > "message"-Field to the new default query field, that is normally available > > in any event. > > > > The problem is that we also have many netflow-events with the > > netflow-codec that have the following form: > > > > [https://lh4.googleusercontent.com/-CDQQs5e5a7o/U6lUvjikncI/AAAAAAAAACo/LHpMXlYLMWw/s1600/netflow.PNG](https://lh4.googleusercontent.com/-CDQQs5e5a7o/U6lUvjikncI/AAAAAAAAACo/LHpMXlYLMWw/s1600/netflow.PNG) > > > > As you might notice there isnt any "message"-field so the Kibana lucene > > query would run into an error. > > > > My question is - how do i manage it to make this work (disabling > > \_all-Field but search in the netflow-events)? > > > > Thanks for response. > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/9ab09bba-392f-4f77-8937-aa518c22292f%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9ab09bba-392f-4f77-8937-aa518c22292f%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/9ab09bba-392f-4f77-8937-aa518c22292f%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/9ab09bba-392f-4f77-8937-aa518c22292f%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/9f406910-1608-4866-8c9c-42a23f6d8f11%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9f406910-1608-4866-8c9c-42a23f6d8f11%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![german23](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/german23/32/11052_2.png) [@german23](https://discuss.elastic.co/u/german23)\ **Post date:** [July 14, 2014, 11:12am UTC](https://discuss.elastic.co/t/disabling--all-field-but-keep-netflow-events-searchable/18288/4 "2014-07-14T11:12:58Z")
Anyone got an idea how to realize that? I think that there are a few uses which got Netflow AND other types of events inserting into Elasticsearch and for those a disabled \_all Field would save much hard disk space -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/2b19c405-46b0-483b-9d22-73fa0c6dca5b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/2b19c405-46b0-483b-9d22-73fa0c6dca5b%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Ivan](https://avatars.discourse-cdn.com/v4/letter/i/df788c/32.png) [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Post date:** [July 14, 2014, 9:05pm UTC](https://discuss.elastic.co/t/disabling--all-field-but-keep-netflow-events-searchable/18288/5 "2014-07-14T21:05:41Z")
This technically sounds like a Kibana question, so you might have better luck with the Logstash mailing list. Can't you simply prepend the field name in the query instead of relying on the default field? You can also change field names in Logstash. Another option is the copy-to-field. Similar to \_all, but with more flexibility. > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. Cheers, Ivan On Mon, Jul 14, 2014 at 4:12 AM, horst knete [baduncle23@hotmail.de](mailto:baduncle23@hotmail.de) wrote: > Anyone got an idea how to realize that? I think that there are a few uses > which got Netflow AND other types of events inserting into Elasticsearch > and for those a disabled \_all Field would save much hard disk space > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/2b19c405-46b0-483b-9d22-73fa0c6dca5b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/2b19c405-46b0-483b-9d22-73fa0c6dca5b%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/2b19c405-46b0-483b-9d22-73fa0c6dca5b%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/2b19c405-46b0-483b-9d22-73fa0c6dca5b%40googlegroups.com?utm_medium=email&utm_source=footer) > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQC2woJNr301UbpbzA6fh6SAh2SJf8NE9NKtr9dh-M8\_3Q%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQC2woJNr301UbpbzA6fh6SAh2SJf8NE9NKtr9dh-M8_3Q%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:15am UTC](https://discuss.elastic.co/t/disabling--all-field-but-keep-netflow-events-searchable/18288/6 "2017-07-06T01:15:51Z")