We've structured our logs so that we have only a few indexed and searchable fields and all the rest goes into "extra" field that is not indexed and can't be searched (so we put there arbitrary keys and values that can also be deeply nested).
Everything is fine but all of these "extra" garbage is shown in "available fields" section and makes all the page hard to use sometimes.
"Filter by type" feature helps a bit (you can choose "searchable" there) but it is not saved and needs to be clicked manually every time.
I've tried to use "source filters" according like in this question:
and field really disappears from available fields but it also disappears from the data in table itself which is not acceptable.
Is there any way to exclude some particular field just from there (or even whitelist what can be shown there)?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.