Fields once created don't seem to go away even if all records with those fields are deleted

[grimespm (paul)]

i put some data into kibana that had some fields, and have since deleted the records containing those fields, but if i delete the index and create it again those fields show up. how can i get rid of them?

[jen-huang]

Hi, are you deleting and re-creating the Kibana index patterns? If so, your Elasticsearch index for those documents still has the same mappings. You can try deleting the index itself completely, or updating the mappings to not include that field.

[grimespm (paul)]

if i delete the index, do i lose all my data? i removed the index pattern via the normal management ui which i guess isn't the same. the mappings updating doesn't have a clear example of removing a mapping

[jen-huang]

Yes, deleting the index will remove all the data. You can get the current mappings for the index first and edit the response to remove the field, then perform the update with that JSON.

For a simpler solution, you can also try running an update by query, which is basically a re-index into the same index name.

[grimespm (paul)]

i can get the current mappings. how do i edit the response to remove the fields i want?

eg very specifically if i do GET lmec-performance/_mapping
i get
{
"lmec-performance": {
"mappings": {
"results": {
"properties": {
"blkio_stats": {
"properties": {
"io_service_bytes_recursive": {
"properties": {
"major": {
"type": "long"
},
"minor": {
"type": "long"
},
"op": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"value": {
"type": "long"
}
}
},
"io_serviced_recursive": {
"properties": {
"major": {
"type": "long"
},
"minor": {
"type": "long"
},
"op": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"value": {
"type": "long"
}
}
}
}
},
...

and i want the entire blkio_stats section removed