# Fields count in elasticsearch indice

**URL:** https://discuss.elastic.co/t/fields-count-in-elasticsearch-indice/258138
**Category:** Beats
**Tags:** filebeat
**Created:** [December 9, 2020, 2:23pm UTC](https://discuss.elastic.co/t/fields-count-in-elasticsearch-indice/258138 "2020-12-09T14:23:39Z")
**Posts on this page:** 11
**Page:** 1

<div class="post-metadata">

### Author: ![malcolm666](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/malcolm666/32/69835_2.png) [@malcolm666](https://discuss.elastic.co/u/malcolm666)
#### Post date: [December 9, 2020, 2:23pm UTC](https://discuss.elastic.co/t/fields-count-in-elasticsearch-indice/258138/1 "2020-12-09T14:23:39Z")

</div>

Hi.  
I have elasticsearch, Grafana and some beats deployed in k8s. Version is 7.6.1.  
There are some fields from my configuration:

```auto
# env values
      - env:
        - name: cluster.name
          value: k8s-logs
        - name: node.name
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: discovery.seed_hosts
          value: es-cluster-0.elasticsearch,es-cluster-1.elasticsearch,es-cluster-2.elasticsearch
        - name: cluster.initial_master_nodes
          value: es-cluster-0,es-cluster-1,es-cluster-2
        - name: ES_JAVA_OPTS
          value: -Xms7g -Xmx7g
        - name: ELASTIC_PASSWORD
          valueFrom:
            secretKeyRef:
              key: password
              name: elasticsearch-password
        - name: http.max_header_size
          value: 20000kb
        - name: xpack.security.enabled
          value: "true"
        - name: xpack.security.transport.ssl.enabled
          value: "true"
        - name: xpack.security.transport.ssl.verification_mode
          value: certificate
        - name: xpack.security.transport.ssl.keystore.path
          value: /usr/share/elasticsearch/config/elastic-certificates.p12
        - name: xpack.security.transport.ssl.truststore.path
          value: /usr/share/elasticsearch/config/elastic-certificates.p12
        - name: xpack.monitoring.collection.enabled
          value: "true"
        - name: xpack.monitoring.elasticsearch.collection.enabled
          value: "false"

# resources
        resources:
          limits:
            cpu: "3"
            memory: 14Gi
          requests:
            cpu: "3"
            memory: 14Gi

```

All works good. We have one index pattern (filebeat-\*) in kibana with huge mount of fields (62000 fields)  
Kibana works very slow when opening setting of this index pattern and when opening the dashboard that uses this index pattern.  
So... Please, help me understand the issue. Is it "normal" to have so many fields in index pattern?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 9, 2020, 10:37pm UTC](https://discuss.elastic.co/t/fields-count-in-elasticsearch-indice/258138/2 "2020-12-09T22:37:08Z")

</div>

What version(s) of the stack are you using?

---

<div class="post-metadata">

### Author: ![malcolm666](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/malcolm666/32/69835_2.png) [@malcolm666](https://discuss.elastic.co/u/malcolm666)
#### Post date: [December 10, 2020, 6:31am UTC](https://discuss.elastic.co/t/fields-count-in-elasticsearch-indice/258138/3 "2020-12-10T06:31:24Z")

</div>

I wrote it in my message 🙂  
7.6.1

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 10, 2020, 6:32am UTC](https://discuss.elastic.co/t/fields-count-in-elasticsearch-indice/258138/4 "2020-12-10T06:32:02Z")

</div>

For the entire stack - Elasticsearch, Kibana and beats?

---

<div class="post-metadata">

### Author: ![malcolm666](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/malcolm666/32/69835_2.png) [@malcolm666](https://discuss.elastic.co/u/malcolm666)
#### Post date: [December 10, 2020, 6:32am UTC](https://discuss.elastic.co/t/fields-count-in-elasticsearch-indice/258138/5 "2020-12-10T06:32:31Z")

</div>

Sure

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 10, 2020, 6:33am UTC](https://discuss.elastic.co/t/fields-count-in-elasticsearch-indice/258138/6 "2020-12-10T06:33:02Z")

</div>

Ok, what modules are you loading in Beats?

---

<div class="post-metadata">

### Author: ![malcolm666](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/malcolm666/32/69835_2.png) [@malcolm666](https://discuss.elastic.co/u/malcolm666)
#### Post date: [December 10, 2020, 6:37am UTC](https://discuss.elastic.co/t/fields-count-in-elasticsearch-indice/258138/7 "2020-12-10T06:37:38Z")

</div>

For filebeat I am using two versions - 6.8.12 (deployed outside of k8s) and 7.6.1 (inside of k8s).  
So much fields are generated in 6.8.12 version of filebeat. This filebeat uses log as input without modules.  
The problem is not with beat. I am just asking about fields count.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 10, 2020, 6:40am UTC](https://discuss.elastic.co/t/fields-count-in-elasticsearch-indice/258138/8 "2020-12-10T06:40:17Z")

</div>

Yeah but Filebeat is generating these fields, so it's a relevant area.

It's not really normal to have an index with that many fields. I don't know if this situation improved in later versions, but let me move this over to Beats and see if anyone can help.

---

<div class="post-metadata">

### Author: ![malcolm666](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/malcolm666/32/69835_2.png) [@malcolm666](https://discuss.elastic.co/u/malcolm666)
#### Post date: [December 10, 2020, 6:41am UTC](https://discuss.elastic.co/t/fields-count-in-elasticsearch-indice/258138/9 "2020-12-10T06:41:36Z")

</div>

Thanks! Will wait for answer

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 10, 2020, 6:42am UTC](https://discuss.elastic.co/t/fields-count-in-elasticsearch-indice/258138/10 "2020-12-10T06:42:52Z")

</div>

🤘

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 7, 2021, 6:42am UTC](https://discuss.elastic.co/t/fields-count-in-elasticsearch-indice/258138/11 "2021-01-07T06:42:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
