Hide empty fields imported from Filebeat & winlogbeat template

Elastic Stack Kibana
1

Hello,

I'm using filebeat and winlogbeat 8.13.2 and have run the setup command for both to import the templates, but it seems to have imported the empty fields and thus kibana is showing them.

It was discussed years ago that it was a bug but years later still the same ?

How to fix this ?

image
image980×1138 139 KB

Thank you for your help !

2

This is unfortunately an issue with how Beats templates work and how Kibana Discover works.

Kibana Discover asks the Beat indices (filebeat-* and winlogbeat-*) for all the fields in their templates and lists those, splitting it into fields that have data and fields that are empty.

The issue is that Beats use large combined templates, even for fields from modules that aren't enabled so the field list is very big and many are always empty since you're not using those modules.

Luckily you can simply collapse the list of empty fields or use the search bar to find the set of fields you're looking to understand.

3

Thank you !

To solve this definitely, I will look to create a logstash filter that removes empty fields.

4

I'm not sure if that will help, because it's not based on if the fields are empty in the documents, it's that they are defined in the mapping but no documents populate those fields.
So rather you'd need to edit the mappings I think but that might not work well across upgrades.

5

Thanks for the update, so the only solution is to collapse the list from Kibana.