Dynamic index creation

[siakc]

From what I understand ES tries to create index by some rules from incoming logs (which I think we call documents).
Now I have too many fields in my docs which ES creates index for. What I need is to stop it from including each new field it sees into index.
I could create and index template and somehow tell ES to only include the fields that are in that template.
Am I seeing it from the right angle and is that what I want to do sane and valid? If so how can I achieve it?

[Alex_Salgado-Elastic (Alex Salgado)]

@siakc

From what I understand ES tries to create index by some rules from incoming logs (which I think we call documents).
Now I have too many fields in my docs which ES creates index for. What I need is to stop it from including each new field it sees into index.
I could create and index template and somehow tell ES to only include the fields that are in that template.
Am I seeing it from the right angle and is that what I want to do sane and valid? If so how can I achieve it?

Please see if this helps to clarify: How to index only some of the fields of the entire document? - #9 by stephenb

[siakc]

It gives some clarity. Can we change the behaviour of adding each new field to index by ES?

[leandrojmp (Leandro Pereira)]

@siakc

Can we change the behaviour of adding each new field to index by ES?

You can create a template and set dynamic to false as mentioned in the documentation.

[stephenb (Stephen Brown)]

Hi @siakc

@leandrojmp advice is correct,

The link above was in reference to the Elastic App Search solution which is easier to use but less flexible.

If you are just using plain elasticsearch setting dynamic to false In an index template is How to stop additional fields from being added that are not already defined in your mapping.