How to add/remove fields in index pattern

Elastic Stack Kibana
1

Hi,

I have ELK stack 6.2.2 installed and filebeat 6.4.1. I am using filebeat to send logs from "Loader" application installed on windows to ELK. The index fields I see in my Kibana Index Pattern, have fields like kubernetes, IIS, apache/traefik (snapshot of few attached) which I don't want. How can I remove these fields and add new fields which I need.

image
image.png1384×693 49.1 KB

Can someone pls help here!

2

I believe that index mappings are used to created kibana's index patterns. (May want to ask over in kibana to be sure).

Assuming that ^^ is correct updating the mappings will influence the index patterns. Unless those fields in question are dynamic mappings, created because there is actual data in the index for those fields.

If that is the case, you can use Logstash's remove field to prevent that data from getting to the index, or you can use the Ingest node's remove processor.

3

There is nothing in log file related to IIS or apache. and Neither Dynamic mapping has been configured.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.