Enabled = false, still indexing everything in kibana

My template + What's being written

Still have everything showing up and slowing interface

Kibana index does not detect fields

Setting enabled: false on a field in your mapping will prevent that field from being indexed by Elasticsearch, but it's still stored in the _source field if it's included in the documents sent to Elasticsearch, and it looks like that _source is what's used by the Kibana Discover tab.

If you want to keep those fields out of the _source entirely, you could remove them at ingest time using an ingest pipeline, specifically using the remove processor. If you want those fields to be stored, but not displayed in the Discover tab in Kibana, I'm not sure if there's a way to do that - it would be best to ask in the Kibana category on these forums.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.