Filebeat and Metricbeat index have tens of thousands of fields

Elastic Stack Beats
,
1

Currently running Elastic Cloud 8.9.1
Our Filebeat and Metricbeat versions match that for the most part. There are a few older systems that are using 7.13.x beats that feed into our index, but most use the 8.9.1

Our Filebeat Index currently has over 30k fields, Metricbeat is around 8k. I've searched online and through the forums for a way to reduce that field count.

I've seen suggestions that we use the Ingest management to identify fields that aren't being used, but I'm unfamiliar with how to do it.

So I guess my question is two-fold; first, is there an easy way to reduce the total field count for these indices. Second, is there some kind of best practices or standards guide for these beats that we can give our developers to implement, that will keep our data ingest cleaner?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.